Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe
Resource
win10v2004-20231127-en
General
-
Target
a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe
-
Size
6.9MB
-
MD5
2b70d3700aa736c0cf0c26dcfef54a33
-
SHA1
fb3ac7cd4cd0668acf00a4f669ee118499921515
-
SHA256
a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2
-
SHA512
46bce96fec23e19b4ec4577a35b51c7f683aab43f07661e4bdaad87241ea7d8855070710702afa54760da83a7696ec6b5f0b2d127a328b16301d0a86843deaa1
-
SSDEEP
196608:aDoG3bFqjpLC0TSMLsn33HR83v9i8l7INzj:aDyNLCWZ2HS9iQ7INzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 4836 wmaconvert.exe 4784 wmaconvert.exe -
Loads dropped DLL 3 IoCs
pid Process 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-4PRS9.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-QJ5MS.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\is-3PMNG.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-1IP9B.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-11K83.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-RQEFO.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-UPHCE.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-2ST39.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-S3C6J.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PJKU4.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-EMARA.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-EIKA4.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6DEOC.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-H5MJM.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-D6LH7.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OSN5F.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-H9L1C.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-FUOMF.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\wmaconvert.exe a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-6PP87.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MDGKI.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PPFKU.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-SF62M.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-NPF2V.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-E39MD.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\lessmsi\is-JRQOQ.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-5AOHK.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-BNH19.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PA8N9.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-NL0LJ.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-GUCRA.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-4PRVR.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-AKPNI.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-L72P8.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-C80B4.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3FK2T.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-16UL7.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-BDLP2.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OSPNA.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PGTCD.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-P0QCV.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-C4K92.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\is-5D92K.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-O43T7.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-BNRON.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-AO46P.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PNAAC.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-HN4IJ.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-STV2S.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-AVL1B.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-IKVK0.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3687R.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-5MRK6.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-BOTRC.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-LK643.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-DO937.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LT848.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-VB6T8.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LJFUO.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-8F6AR.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-H2OJ0.tmp a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4352 wrote to memory of 856 4352 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe 86 PID 4352 wrote to memory of 856 4352 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe 86 PID 4352 wrote to memory of 856 4352 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe 86 PID 856 wrote to memory of 2084 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 90 PID 856 wrote to memory of 2084 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 90 PID 856 wrote to memory of 2084 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 90 PID 856 wrote to memory of 4836 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 92 PID 856 wrote to memory of 4836 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 92 PID 856 wrote to memory of 4836 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 92 PID 856 wrote to memory of 1872 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 95 PID 856 wrote to memory of 1872 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 95 PID 856 wrote to memory of 1872 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 95 PID 856 wrote to memory of 4784 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 94 PID 856 wrote to memory of 4784 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 94 PID 856 wrote to memory of 4784 856 a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp 94 PID 1872 wrote to memory of 5092 1872 net.exe 96 PID 1872 wrote to memory of 5092 1872 net.exe 96 PID 1872 wrote to memory of 5092 1872 net.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe"C:\Users\Admin\AppData\Local\Temp\a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\is-K90U3.tmp\a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp"C:\Users\Admin\AppData\Local\Temp\is-K90U3.tmp\a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp" /SL5="$500E8,6971036,68096,C:\Users\Admin\AppData\Local\Temp\a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2084
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
PID:4836
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
PID:4784
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:5092
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD596c8f2ec68639ba818e69c26caf03905
SHA1d329dd7f2978043c55ae596f9237e0a6c2770a85
SHA25660c7cf3ba354c8a9d8cedff893111fdaceeda2e717bc55c77da5b7d3acf035d0
SHA5128cccc6dc43bb122fa5cba9b5f633e7f73727e066b8fc2c8693c5d47aad069e096cbeabffa8d5cbb21255a140d8e3c1e49311f815f6ff9b46ba6f7c9e13c733d4
-
Filesize
897KB
MD53e7be95a906633cb9729e3df0db69ba9
SHA16a12a9a209318247db7c22514b1b16ae73fd79a0
SHA256a5a29fcaa10ed6decea0e6f30411b65cdb8e761b70fd0191d1a22fbc6fa08a38
SHA512046b8baac9e0085e4f6b6b5cbd456a836da9380779b37aef9ce6eb295298a274d65d62df686b4da99edef66b8564a5bb4d56730692446b3717c947d3c04dc998
-
Filesize
226KB
MD59ae4654939d10de5cb196968c55732f7
SHA1c0ba5072bb6b5bfeb912636e81607ea88fb17eaf
SHA256d810a05e7341e7b00946269eb951a00540a2d26052131583728a0e93b82b7933
SHA512ac493cc0ea4a74e7f616916cb3a48c12f758fb83e65343004e3daaff285cff54d3a7ca61f1db52241541857ce26ff585476fdc99b9afb1e375a00cfb674f534c
-
C:\Users\Admin\AppData\Local\Temp\is-K90U3.tmp\a60256a3ad4f2e083b5222aeab7f47546e002c4368d8cff9634787fbfe9b42e2.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303