Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe
Resource
win10-20231020-en
General
-
Target
b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe
-
Size
6.9MB
-
MD5
8906fa2ec5cd7506bee6a7bd6c67f891
-
SHA1
545a5ba9c1291d487c21dfdccb9b5fa8e03bbbe7
-
SHA256
b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9
-
SHA512
54e17344597f0398575a8c77bc4ba4f9f3f22f331921e50b7f279c8d66140f346102e6d49afb8ee92cd388f8b7fc3f53499106a9bf2bea1985fdc5cde0c14e66
-
SSDEEP
196608:JeusL5Sg97UrK5EvfjuiKsrGugWn7juD9k3Ozj:8Vsg95KnxLrGufn765k+zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 5096 wmaconvert.exe 5060 wmaconvert.exe -
Loads dropped DLL 3 IoCs
pid Process 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-CVVH0.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-VM9QN.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MO0UT.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-HPOBF.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MCA6F.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-BC9G8.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-FJ2PK.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-LTJSQ.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6TJDT.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-4Q4NH.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-KKECR.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-330IN.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-BSC6V.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-IUETH.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LN5FA.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-CHDDD.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-81533.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-6OJND.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-SIJAQ.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-R6F8M.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\plugins\internal\is-OUUHI.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-DMS9O.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-AONT6.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-EKVC2.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-BK69U.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-GGDMS.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\lessmsi\is-RG9NI.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\is-20JKP.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-D2LGG.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-50ODG.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-O5S83.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-9C0UG.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-Q6PT6.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-OBET4.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File opened for modification C:\Program Files (x86)\ConvertWMA\wmaconvert.exe b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-2H0C0.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-JSOSH.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\stuff\is-TQA2O.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-545FU.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-0654V.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-8J8KS.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-UGSI2.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-UTAMM.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-VBETN.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-459NB.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LAGG8.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-1K9NA.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-KLO5I.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\is-LK49S.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-H91UH.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-QPL3N.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-FH3J0.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\uninstall\unins000.dat b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-MQOHV.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-D5RHE.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-GAD0N.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-37RH2.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-LPJ7T.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-1PCIC.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-HA053.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-3J6KG.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp File created C:\Program Files (x86)\ConvertWMA\bin\x86\is-PLFR9.tmp b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 764 wrote to memory of 5024 764 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe 28 PID 764 wrote to memory of 5024 764 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe 28 PID 764 wrote to memory of 5024 764 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe 28 PID 5024 wrote to memory of 424 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 72 PID 5024 wrote to memory of 424 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 72 PID 5024 wrote to memory of 424 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 72 PID 5024 wrote to memory of 5096 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 73 PID 5024 wrote to memory of 5096 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 73 PID 5024 wrote to memory of 5096 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 73 PID 5024 wrote to memory of 4288 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 78 PID 5024 wrote to memory of 4288 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 78 PID 5024 wrote to memory of 4288 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 78 PID 5024 wrote to memory of 5060 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 76 PID 5024 wrote to memory of 5060 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 76 PID 5024 wrote to memory of 5060 5024 b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp 76 PID 4288 wrote to memory of 4128 4288 net.exe 77 PID 4288 wrote to memory of 4128 4288 net.exe 77 PID 4288 wrote to memory of 4128 4288 net.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe"C:\Users\Admin\AppData\Local\Temp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\is-8PRSC.tmp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp"C:\Users\Admin\AppData\Local\Temp\is-8PRSC.tmp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp" /SL5="$600D0,6944675,68096,C:\Users\Admin\AppData\Local\Temp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:424
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
PID:5096
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
PID:5060
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:4288
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵PID:4128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
373KB
MD5c33300cb7b34e45f9d04fd7ffe5db5f6
SHA1dd20530ee97aefe595c05878d4d7407b8aff9534
SHA256c99c122e697c079a8d7723b1b853d7f491ca1b646ee1e5449f8e62c75b19240c
SHA512b3188d75d6db6e47960b0dcb67a7a77d86faadbb2d34fa0846f05da3c0c3f2c1110cf734bbf9fd08f6dab625343b996a1cff3ddcfb1421db5ed38ed783e7a8f3
-
Filesize
299KB
MD51fb085cc6710ee2d0d25db0763af3851
SHA1866343bdecdf252704968cbd15105f2b0f4ab77f
SHA25695f222ac4f183dddc60d4824760512acb67acf6b63469dcac8d80fbe1ed63b59
SHA512e8e34509c9c9f7f996af4140ce8b5bc0962567cee284001d072c26e8e33567280e0e76f7f56f441a038137ce3f497a8ca54a9004ed302228ea3de1c7ea4f0fa8
-
Filesize
112KB
MD5297c9f59bdf649bce6e8c88bad76727e
SHA134a099051e2476626b9915283e24ecf8b2f530dc
SHA256b8c3275d5228ceaf402e35e73ff3f9e5bca7e766a0c65f0f1a8c5a0cfd2c330d
SHA512a16e43f6064c2de80473c2399bd30f4de4c15930d3367726a4c3835ee516c7307d2cabc18c4ae2b93d855166828c3d04827f10eb67caa6b3be456375c382d567
-
C:\Users\Admin\AppData\Local\Temp\is-8PRSC.tmp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp
Filesize546KB
MD58d7487830d37629dcc25406994819ee3
SHA152aa971c5535221c7e1bafc49b36cb1f31ec2ec9
SHA25626516a737a8c61634bd0a600b56c563512d1584fc03b9ab184bf4b3682f7b2da
SHA5124225c4dc476a2897fa0d734df1ed2714a85fb2b8d18ab3cdeed43537f825316a516df193a7d3e6a64a3fef5add7f589f931542618977b116978794463883a9b4
-
C:\Users\Admin\AppData\Local\Temp\is-8PRSC.tmp\b6ba794a4db95c699db59430de2198b1b37d3bfe2849f2216bced09868ade0e9.tmp
Filesize291KB
MD50793f0fc0c830bb96044ed4517a18148
SHA12670fb59f8a852b23d34954d424a776a26e2e985
SHA256bdd89c1b27fd6f6e1c2bec55ba0b5c2882245ea9c0ad6f397d95d69b73bc9114
SHA51225124470429678aaa6e1e60039f461b35516fefe7ca877615ceb2f7b58fd9e3e5d4d9917fafed2bd3274ee060381c4f690f40e201d618a93af311ae1eea714ad
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303