Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe
Resource
win10v2004-20231130-en
General
-
Target
ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe
-
Size
6.9MB
-
MD5
8b3dc020d2f44ddb51593c5568932c3b
-
SHA1
be1cc6033fc318b5ecf7ff821e453cf394e23293
-
SHA256
ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c
-
SHA512
81dcaa56588d3f0c21ca5cec07722221714c0f5a8ce91ee3d44be65e2df32245eb114efe6a4bfdd64d0911554da8c720b3bf3f2f49dfcc0db6b9409635b4bc44
-
SSDEEP
196608:wW0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:wtO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 1556 wmaconvert.exe 3924 wmaconvert.exe -
Loads dropped DLL 3 IoCs
pid Process 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\ConvertWMA\uninstall\is-8JNGQ.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-G3IJL.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-KR1A5.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-KD84C.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-EN2AR.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-5314M.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-KQ9I2.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-2CAEG.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-GOKES.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-TOSG2.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-P2IAJ.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-D1PV7.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OH6RS.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-B4SO1.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-ALVGH.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-G3DAU.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-NN3UJ.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-78K54.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-N923E.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-BB4H9.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3SB42.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-HB1SK.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\wmaconvert.exe ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-19BK9.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-L6212.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-SDV88.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-6GHR8.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6I7AG.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-F1GKJ.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\is-9M4O2.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-NVQKV.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6AVIA.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-P3JAT.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-IVNSE.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-JVHPN.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-A1FNL.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-IVN60.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-TLUFG.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-A06OM.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PC74F.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-FHEBK.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\lessmsi\is-1LU28.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-085GC.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-VDPDM.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-VVP5U.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LBQ9B.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-UQGTE.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-45U24.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PBHJC.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MQAQJ.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OUJDI.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-9RNFO.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-8UOUO.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-2NS15.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LH0F3.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-SCREU.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-J399K.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-RCJP9.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LS1R9.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-JN8FG.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-I8DNC.tmp ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 512 wrote to memory of 8 512 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe 26 PID 512 wrote to memory of 8 512 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe 26 PID 512 wrote to memory of 8 512 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe 26 PID 8 wrote to memory of 2448 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 50 PID 8 wrote to memory of 2448 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 50 PID 8 wrote to memory of 2448 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 50 PID 8 wrote to memory of 1556 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 55 PID 8 wrote to memory of 1556 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 55 PID 8 wrote to memory of 1556 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 55 PID 8 wrote to memory of 2252 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 54 PID 8 wrote to memory of 2252 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 54 PID 8 wrote to memory of 2252 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 54 PID 8 wrote to memory of 3924 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 53 PID 8 wrote to memory of 3924 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 53 PID 8 wrote to memory of 3924 8 ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp 53 PID 2252 wrote to memory of 2344 2252 net.exe 52 PID 2252 wrote to memory of 2344 2252 net.exe 52 PID 2252 wrote to memory of 2344 2252 net.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe"C:\Users\Admin\AppData\Local\Temp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\is-G17PI.tmp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp"C:\Users\Admin\AppData\Local\Temp\is-G17PI.tmp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp" /SL5="$801D2,6973457,68096,C:\Users\Admin\AppData\Local\Temp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2448
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
PID:3924
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:2252
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
PID:1556
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD574f8dfca7fa6f8f1d28850b47eea9582
SHA17af43b4b1e96a6725aa511af7fb485f5358dfc25
SHA25620b2bf7b6f3906db95a265a1f165a67653759104136e833efc157e9b900e5597
SHA512e7e9fab0d0f1b5571144262c6830d6f5a44404caf2e4f9dd957a8160a6b4140e4beaa4765ede7631fc95fb6e1b58febcbd2a15ceb6030a93851d35bb410daae3
-
Filesize
115KB
MD52bea65b2ae8d0a7f3d43def40aabefea
SHA151c14cb47859fbf5fe2b79dbb560e0c8a7e60d50
SHA2565e165df2fd8512d9fbfc687598ddfa3a11c14bb42bbb55597625557d754360e1
SHA512b746baf9d291b7cd92bb129212fb151aed14813d57c55d28b5d1c0285dc2be00d73d7e93e74437bfa58faf270bfe5d99834d22d575f5e85b0a8bb1a8a7875117
-
Filesize
143KB
MD54a8d6b727249a3f78b754f0bd32e5383
SHA18116ff9c318ccc5040124639c6c527621e17e051
SHA256df4a60ad556c00192713aa209928258e8dd17f9ed35b857370283b9e5ce2d838
SHA512e344ef6b44a9e0c104fdcb0a71266ecf117e19b132c9dd617c405b810db17264dc326368a0b758881d9e69918c11d8f00d6f805de267aea10110dcf773283d31
-
C:\Users\Admin\AppData\Local\Temp\is-G17PI.tmp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp
Filesize328KB
MD5159e42c0f096df581d8babdf124ed381
SHA1e1f29975bb013639945e974081f800171bcc55d7
SHA2569aa17f6390d2cb96ae55f57df8fcfb5dec8d65f90d76dcc38f1fff5ee75b5ea9
SHA5126280449ac2a0d71c2cdfe093ab67bf21a96578d33871e941912349d0897c3f7d0d084ea4be676b101b289fe3c54fccea3e1e1a4c0547059081fdffd5c5b14b98
-
C:\Users\Admin\AppData\Local\Temp\is-G17PI.tmp\ee6011b068adeaac3225c889d74666f1f54621679b6eed56af5dcd1f804b782c.tmp
Filesize261KB
MD58d1e478b2b3e9d5785a8a335a901d659
SHA13d2feb407043fd31592d61c942acb378f16f2643
SHA25653528bdd97fbf71ad5866e43a6ce1ad5527acc22262b673c56a04dd563a17fd7
SHA512c2ba9d13995f4e44187bcd573f4a0e720fe2f409e3f68844d501132064601d24deb044302fff8d95b65d2c7fa539399fc61b2cffc98da76ba9254a928be8e7de
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303