Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
11/12/2023, 16:55
General
-
Target
tuc4.exe
-
Size
7.5MB
-
MD5
807946fc465ebb7fb9a4dd9e056fd4e1
-
SHA1
63bd4777b6af4c25b330575d57155b6b61b94aab
-
SHA256
9e2c5313f874ec182f871c988629d370b004f61274b009239b3ed5a193afafcc
-
SHA512
a47b31ecdf9515a8126f934b083e188561028c25d7154d28dfa4f78d2cbc51b3e2d283d78ad20a46d02051bb72745d99ccc63120667bc32227f4d5709086965f
-
SSDEEP
196608:OpVDDR8SZqepbLqwjKpDf/NIpEpDqfBrT0/WViLFfzj:OpVBtvpbL/+vVYBrTTefzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc4.exe"C:\Users\Admin\AppData\Local\Temp\tuc4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7FIN1.tmp\tuc4.tmp"C:\Users\Admin\AppData\Local\Temp\is-7FIN1.tmp\tuc4.tmp" /SL5="$7011E,7565670,68096,C:\Users\Admin\AppData\Local\Temp\tuc4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD55d0386df1ce39a078dd3330dd327642c
SHA1e12f6dc7a75db4fcd0cfa0d0f6fcd63135f5b211
SHA256903f5971896aa85a59f65d4e1ef1142a56d0d21b43fdc064cf7e1ce6885f2b90
SHA5125802eae8ad28c21a5f956b20913f215bd736ef19469216a76664ac783195118b0749481cb21c06ee6d8c9fa3418e4763c0e455eea07cb9db2fc0091c9adf0751
-
Filesize
822KB
MD51d5acd9a257273c6d4c5c4bc04f1470c
SHA185c50cbeb68370c94acc26ac4c35e33c067d7bd8
SHA2563300435f6b909bbefb3f15ca3a690c496f7bf640c2b3066ab8a7e626194932f9
SHA5124f9a56727af2a0fa3d4fe584e397a78b4b38dccd2cf051e729f8a754754f15b65d768ac000b3c6c0bee184504dd37e82ee1804a3b424520636257f9aca1b5b0c
-
Filesize
601KB
MD58b2f12f9fed573d5b5fab70d4744f171
SHA11be0b08c2ba6defec4a0cf45a7df343e0e554823
SHA25693ec09ab0ecf40a0a35232e083d38b90b51a386d01ca9ce4e1f0e14e64fe0b6a
SHA51201ca1a9b6751905ebb043980ffad0f4b367de731a0736235dfaa6ff37fb9ca7e1b48a4b63e609abf94a3681f3eaa10800aa6b517a797d49c48634e7e197c57c9
-
Filesize
573KB
MD5829cb872e5ab50dffa84ad86a5551863
SHA140c5019bb2bcc2f4e5c88e0e7da2a68d115c54a7
SHA256bc2fa66c3e9be9e98e6823ffb973dd33ceac5e883c2eaa4f71f68586eca05ece
SHA51282532bf905e7a1fbdc61984e573d756012bdb9a677fb756617a055f2b167b34e47ab7bfb69053b9d5361a6788be1fbe718403e80aaed3fb45bb9882f6c7b573b
-
Filesize
430KB
MD56c3dc24491a127b350e84d61f2d7d73f
SHA1a410483f767b8a0e7d853f987300e9e2829c66b8
SHA25667b11178c934393076c9a809358701411e7cecfd3105f825bebc97c2e54a8b07
SHA5129a186a2d61d65ed22286fd4c2e201308e0b8374088935031e9d5998c0c9cd41604f707ebe6fbb1774d2010caf501ba41db475d7eaf04f11de398f1280d47d4cc
-
Filesize
1.4MB
MD51612c687b1d60ca93b27f7add3979f0c
SHA1f91aa6d4b7639fd9ecb9235204400b97e791dfd4
SHA25643189743f4684e5ad27a0a853b260376ce2b0640ec3f556c1756e15118c71407
SHA512d75a42586c9f90ef0e269a694dc24c3cd9dba6553ff16fb84b48d80cfbc2aa350524ccc816a2f009bd676531dc5c15c937ef7eb3bb03c8e6762446c1216a3efc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
526KB
MD5d8777dd511e08379667932fe6b213c05
SHA1a31c8edd733bd4bfcadf1adf2faf4eef07d704c4
SHA25606f27f1cdaf366e6069c0d2c67b3e4947bc93353a21ed24dc23eebc69274121d
SHA512e5faf654deb73845616f4fb175e23c26b4155948b7b6f0c957972b2a727fae7771d960da62a7114fb558b3dd6848028aa5beae50281aec4e4bd26c3a2e02d14a
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB