Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
11/12/2023, 13:09
General
-
Target
tuc5.exe
-
Size
6.9MB
-
MD5
709bf5fb1dd46de18fd3d6494d8cdd91
-
SHA1
15ff2e409b3bec7be940e6f51081db6f78777a1a
-
SHA256
b0f1c932f12e4e186696f2c11a99c43680f28c84cdba84d377de662f6e283d3e
-
SHA512
24ef81b5d4b20e18ec59531098ff1894e1838fb9e6988282d2ed1086f547175e9cd625819da7a5de0ab36f5f014a43db7edfb7deca2a2a6dac7a1c1b643925d4
-
SSDEEP
196608:oxOlhkHxfDumIwWJfU1IzKkGjAqiuGIqOg9zj:LjkHxfKTnJjzKkRtF9zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc5.exe"C:\Users\Admin\AppData\Local\Temp\tuc5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UQ2CM.tmp\tuc5.tmp"C:\Users\Admin\AppData\Local\Temp\is-UQ2CM.tmp\tuc5.tmp" /SL5="$40150,6950053,68096,C:\Users\Admin\AppData\Local\Temp\tuc5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD55c29d16c77e748f349b037b1e570849f
SHA1066607923545498bd183f5ba1939f1624d699b64
SHA256e7daf751cece94d5f0bc866a250fb9ae4c44282992dcf58c70e510464aab3161
SHA5120b81ea59ad0ea9ea77cd8a78b9845659d4fd9607687939bd1204e2da8e0cffc718e520ad172b00f989ac4d19d422d2501311091fd77e7676fb66c2a4781602a6
-
Filesize
108KB
MD53e19ac94e56eb956f4525f3f48b23c31
SHA1c34c476b6596561c890d259b7137a2bd0afb2712
SHA2562656d940246df3a9d0c2bd676223569d970debd3b4e550cd2673b7bd34af367d
SHA512a2b6b96ac086d54516ce5babe998d98e33896adf756e25b8312efabdb4a6abe3c1ed2cb8d2476d4c24113fc2c15e4b50d47c5fa5ecad331ea167a8e4e9ca02cd
-
Filesize
79KB
MD5a455a9923e09bc9c56d2fddc53a100ad
SHA1ac7561353b3e3a7c810015bf142b17ce8dae553c
SHA256999ae956d8c9072b9e3e368f6269292f0ccf5e7ac66e40034b7b4b3dd25973d2
SHA5122c8c409fa09818be312283fa95bd536805ee7fc83923952af3987235628240cf30d085180618f2d54185b65552ba29ec36f498dfd42b6e33edae0fc37edf9bbf
-
Filesize
240KB
MD5ee8fd0f60018c03d64afbadd18b4e8d9
SHA14d2e501d93cfe0865dc732b4531f50d20ca573b0
SHA2565591bc947743dd49e23135ef092ffc3ce42098bb3c5603277d32d44fb1405a4b
SHA51286815c6eb864d4094e14954aabe49d14524c0de746c01797ccbfcdd80fba37bf1b264b7e2a588add50897ae3a835204ed81baf134f0945a43dd9cf0d8ff9c5f5
-
Filesize
309KB
MD529da4bdf0f9678919a2e7780dfafec96
SHA1c116de2bca12f7450ead2f2d90fac3c61e8f7486
SHA25607db9f6801be153ad2fbfba49463e12dff007d26c0760dbcceca99ac944f3b76
SHA512bff97868e5ce85416ff1a36b115fbcc05eca9f0ac88d28053f12926612124eb3bdcd68d067dd8f2a022f23453cf5399c8d518e856cfc3d49f4521a476a61e624
-
Filesize
45KB
MD5b78ddaea21c328a661acd590b024fa30
SHA17a956981ef217771a55f324d08b0d761b59bb97f
SHA2565e3f5b1be00971a998ffecc0f54101da99b9afc5755b55293c77d89735f6b1ac
SHA512680e39b96674edc86308c70b95ae122b1a2369683b23a264ca5fd2a2f1c5b257808d536ef73cede146d7ac24676e91a1a21cedba0d9880b6c2f9ff9835ca16e5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
303KB
MD5ecf94a08aafbd1c80b7ed0449ab64caa
SHA19aa18e950f8626559f70323da7e6930bc862ecc4
SHA2563463ee849cbed0e97e65a743c563bc2793a39590c8bc37568b6ae7e3eed10212
SHA5127ae3c49666712f2c539e9fb0da46581bd54154a020af5176b3831067361b99b8a217e06b564f0de70e5fcdba82c143caab95e48e0d3bbac2f60b80c0be15a0f6
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB