Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 12:26

General

  • Target

    cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe

  • Size

    6.9MB

  • MD5

    82e79a3551443cf5e201a7ebe9ee0a3e

  • SHA1

    e7fb6563cf07ba276a34e3a97272bb9e77da3c58

  • SHA256

    cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2

  • SHA512

    7ea45b1b5224ca4cbd28d6cfe1d540364c3e1d56412512137d3c6a268533d83e4bc5836c14dcb6928489410ad0823f7ba8ea011d3a70b138bf313a2f3e6d4518

  • SSDEEP

    196608:QxOlhkHxfDumIwWJfU1IzKkGjAqiuGIqOg9zj:TjkHxfKTnJjzKkRtF9zj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe
    "C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp" /SL5="$50212,6950053,68096,C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:804
        • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe
          "C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i
          3⤵
          • Executes dropped EXE
          PID:5012
        • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe
          "C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2684
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 11
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3892
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 11
            4⤵
              PID:3568

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe

        Filesize

        564KB

        MD5

        95b6b8ccc5cc268cdaf543d7f54e1c68

        SHA1

        0d06391c8175ca1c7a892a9394b52c50876d5450

        SHA256

        ca344e18ed8f3b4ee239df195b04c49d8578ade8676cab0564dfce9168137c9e

        SHA512

        43c691916d8f5404ed08ee0daa7a1aca9afbe9a5d663fc056bf7c76fb9ee63b1d205db06784e3abb084e3fbc57a1a3afaff410885fb32d2c9caf401ecde119af

      • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe

        Filesize

        560KB

        MD5

        d4bb71fb20b1d88dde7aaaa34124f54c

        SHA1

        37868a26d5497b0c8d9ebedaebcc5e193824198f

        SHA256

        e2593c3e318afbc89c571042d688909b80f96ed62eb51a94f59298d6381749bf

        SHA512

        c29662ba7dba2b07836872f9cf051df93338bebc09e0275f84a7affe32a686529d02b318f28a18581384c0ec7c5fbf26602cea91b5f74593ac962f21c6e0a54a

      • C:\Program Files (x86)\ConvertWMA\wmaconvert.exe

        Filesize

        364KB

        MD5

        012aa20413d3e47ba1b8c1d034e14f03

        SHA1

        f8fdc1fa8e570d943f5d5002f62c850e7a957c58

        SHA256

        9ed66bcceb0a96736e9465c56da3b7cdd21e3780a66889070fb326aa2e9c20c4

        SHA512

        62d866cb49ea805960df426b57013c5a9273a28ea2a6a41b4cf929db037f43be355eaa95ae16300f8c376d5304645a7c72ade66114b89bbd05b252a0fe583af8

      • C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp

        Filesize

        95KB

        MD5

        bb9dfdbcd3afabe543a56ba40bdccca0

        SHA1

        290d7cccb02aa51a8fd90e11634efaa2b3ffdc1a

        SHA256

        6c9df259fd54eb0d58af51e1b51ec92e92945668fb5145444042afaebb43dd0f

        SHA512

        07d96c03836a78ae591668f3e33353dde30949d24c2d782d5a834f9ac7f5d74bcecbfe7e6b00e713a3499e002bf30c323a83ad430d8f203b3e74beabd8316a8a

      • C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp

        Filesize

        92KB

        MD5

        64c54913ec7cf33c42d3a466c9186e94

        SHA1

        b1a80174afe63f050b81eb6050e0bf49b18dd1fb

        SHA256

        340040f9fa8f9866233e5b9375d62a606b546b2b83bb4caea27126099c3938cc

        SHA512

        c317cf5303a6c6d6a066ec1aed70e1ea83d5f55b669eda0c8d6bb5ea77e98c65223ae391abb0214df891f874a0a1229c8edf7463a17a31bf1524a9f521b3e095

      • \Users\Admin\AppData\Local\Temp\is-M9LHQ.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-M9LHQ.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/2400-162-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/2400-10-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/2400-160-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

      • memory/2424-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/2424-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/2424-159-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/2684-185-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-176-0x0000000000860000-0x00000000008FE000-memory.dmp

        Filesize

        632KB

      • memory/2684-156-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-208-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-161-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-205-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-165-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-166-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-169-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-172-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-175-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-158-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-181-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-182-0x0000000000860000-0x00000000008FE000-memory.dmp

        Filesize

        632KB

      • memory/2684-202-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-188-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-189-0x0000000000860000-0x00000000008FE000-memory.dmp

        Filesize

        632KB

      • memory/2684-192-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-195-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/2684-198-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5012-151-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5012-152-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB

      • memory/5012-154-0x0000000000400000-0x00000000005CF000-memory.dmp

        Filesize

        1.8MB