Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 12:13
General
-
Target
f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024.exe
-
Size
6.9MB
-
MD5
3d3dc727333b8e09f23084bc58de6635
-
SHA1
8b889b7072e95f967aef7e6d211ba6f4186cf84d
-
SHA256
f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024
-
SHA512
9a12bcb9a11dfc7635488da39e6472a2b95367bb7632b260f15445d2a72576ddbfd05a4351a7ddf40d4b57a15772a45da103f2142f024ff36680109e77b0294b
-
SSDEEP
196608:NW0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:NtO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024.exe"C:\Users\Admin\AppData\Local\Temp\f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2VRSP.tmp\f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024.tmp"C:\Users\Admin\AppData\Local\Temp\is-2VRSP.tmp\f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024.tmp" /SL5="$901D2,6973457,68096,C:\Users\Admin\AppData\Local\Temp\f819fe6ff2ad05e297999f1fd00e200c64e2ce4f2b829e173caef04dfa5aa024.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD54d69c7fb60faa5dc28d511b17e0f422c
SHA1e783101cf9c88cb67aded4a04faf3294f372a4b6
SHA256885771053e8338a81df4a7ec25130900556c06732a4d8ae9a3c40b9dcbd27c4d
SHA512b892831b83b18a7c3d0b5b7d8678cd04434f40cc3a051486e29bfc3f59881f7872e61153245814ed6cce263bd976e49b4df66a2fa19402bebbac12f2e778aa7e
-
Filesize
190KB
MD5d264fdfecd4db5f8453ff86125d6ff24
SHA170ac74199d08e626cf6e9d2ee9b5c034d6842218
SHA2563555805c13a361c9f0b35d3ecdf07c0ec79e94dcb610f6a121f5376cd3c47dde
SHA512cd84bb557a16597e7f5f966755be3489a997975835e8e2f6078e98b514ff067cc66089a12484337f952a005aaca4b2efb919f3f55ff947932bce583ea603ea84
-
Filesize
168KB
MD53d696bef5dc62c084298800d18721474
SHA1e83e733b18097c2bd056f0623b798709df6adc45
SHA256adb6996f3f8f375c6d51e18304e4f92e7bb9fc0bc6a6a2b446f9986113874962
SHA512cb3dde5065f64a8be5418778383d894655a6b205f1edca9cc6e314778c94c67c2ca0779df790ee853434b1183e7984f27b1bfd3dfdd79b985a61db88502f3390
-
Filesize
130KB
MD501641e3caa39905e34bf8bda0c6689dc
SHA1de865afea70aa2ab168a57076208396c173a48fb
SHA2565a24c3178179ee08b25405a4ea919464d51c59242ec2e0df827f1496a6a84d31
SHA512da60c9bfce8aaf58be8098457b58a33666e32105ca1902b1d2eb222fb5463bf30f66b8a8f47766da1d62801ce101dbb93e56fce5c70d395c30db77ed06347f8f
-
Filesize
59KB
MD58ca11d94094b7155e8f5660bc135af84
SHA13a434f407586d4a068f90ca923b5141baae72058
SHA25651966542e4023d46cd47571e5c453e32c7f98317efc2da6f3bd81ab4c0787935
SHA512a5371823911373e3e983fc1cfbe2318643a21a7308171970f8ada3dc025cf6257b0fe25809a64e81b809fceb9032aa4c6f93afa507a6f5bf3662f90e9588e207
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
17KB
MD5a2d585cf8e766364a4c73c3aebc52eb6
SHA13041f98c01c23673620ff79def7432f1a86d71db
SHA256f100cd2fe7ded38b10185969a2a403b7cf234dc4daa4ecec0299b4f6698b8626
SHA512a61f8bf16bead2c082f14f3a9b3850a974549e674766a841c66a290f45618657a320e380ea801877fd143daa32b99872bb3917ae9890640b46941da36ec58d1f
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB