Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
-
submitted
11/12/2023, 14:12
General
-
Target
tuc7.exe
-
Size
6.9MB
-
MD5
cfa8e151ffde662bf810677309b55ae9
-
SHA1
79eee243b42540b79e6d1550b3443b168c3bd951
-
SHA256
c2e16de97139bc0967e0f258df08311e25697ddd1a4aa4c8e50e1e95a8d04299
-
SHA512
832eefa37ee34ba0edbfec275e942939d908a238349a2d61d3f5165ebc6af7eb0810cbaccfe33e4a30b351f7c44c7de705a88a55b01e2a2c689c0d68ad1dc93c
-
SSDEEP
196608:weusL5Sg97UrK5EvfjuiKsrGugWn7juD9k3Ozj:DVsg95KnxLrGufn765k+zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc7.exe"C:\Users\Admin\AppData\Local\Temp\tuc7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GBERP.tmp\tuc7.tmp"C:\Users\Admin\AppData\Local\Temp\is-GBERP.tmp\tuc7.tmp" /SL5="$4014E,6944675,68096,C:\Users\Admin\AppData\Local\Temp\tuc7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5c18891ecae5c781d97e735f70ff1b974
SHA1a9df2962998dfa7a5128658fcdba36a4c95be69a
SHA2563209a387e8d6f23f129271a5a9079c6f506e72640a1f622546eeb29f0386dc67
SHA512fdbbcb0a05d6c4794e4541fc791bf828cf8ccb653d677378570e13754557cc2138dcf2f17569852bd9a0f5e5656a64cbe8190c6d24e7233211700dfced77a669
-
Filesize
202KB
MD51c4162f899826ecde6e18ca99038c415
SHA19ab8f8ed03975991d6743fe95773b02fbb8a932f
SHA256a5b49bbbe633953a9ed39ad3ca429255ff06e88c35c32cdaaa5359a44bfe8489
SHA5124b3fd83697f0b501f9c60124089ee1bbb1f97198a3461f0da82645170b9ee16930f12df7d940890629903cf122a9cd3a1b515a35844153aa923197243c18fca1
-
Filesize
262KB
MD5ed29af2d0a3a65f06ab2e6b3090bc4d8
SHA1b46ab58556288c450741cd282ab2ac3a5b37a98e
SHA25601d6fbcae25219b7a6699fb372b451beeee4a31ead0da17bd85fefa4567da56f
SHA5126ec2884f2ec8964a6188832177054aedda49793eca56766784a09e4013e341e307902bd8953706b086aaebabe952e203dc6d28e41f5db043652b8f8e51ef7910
-
Filesize
116KB
MD5937e153af313a40336d08074b8058a68
SHA12faebc01319770cee7e6fe92979799a7f7219422
SHA2564f465908e81af448864a546303f591dc22e6d7b1a566f8a5ad212528026f5e69
SHA512013eb81a400dd49f7f31a7f335645e3ed3fa0aef196a17d24da3e827f6b8c2d1844a74527327c749f9a8d18884841f465607b1d984b57f36d14ded4e61b8ea28
-
Filesize
540KB
MD5f5bf48ff7b0c428a2efde1e002eb9790
SHA1af35d7222fc5b41f581ad0f42ccd38181b4ab5f6
SHA2569d0abe5cf43b832ae6e8ad1a1445dfcc1b8785f1281a82c5879a8eeba5082dd5
SHA512d3581beaf7e284e1f654ae9eae4ac9510f0e3768da2badf9173b289876ac5a2670f36d27978aca93c1e0d837e2eb0b22fe13bf38a95b17ee7db595a57afcd73a
-
Filesize
341KB
MD51630c786adc1064bdeaf36525dee735e
SHA13fafc6ac30731fdef08c2fa8c5735d63b60ae7f0
SHA256d319a712ea0a4f88c224b0302d87d2e446fbf60f8a8d03001603b74ece3868d3
SHA5120d5c24034f7b8f4ddca4bba83436eabb6580c477bc98809234eb41857c83ebd85f905c308fefb818de35b5ff56edd99e3fd9db710337a0e074da7e7cb1e137fb
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB