Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2023, 19:31

General

  • Target

    a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe

  • Size

    7.5MB

  • MD5

    8a3e847cfd7a77890d19dcd5bc6510a9

  • SHA1

    5bc04fe33664e8d5be738e91c037dcd50ae5f8f1

  • SHA256

    a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1

  • SHA512

    30775b2382c43f6a654bfe4c1665aae98d3e02a17a017b9d07982fe6c677c3aa447360cebafe0d972abfc4dffcf95833103aee479dfdf50b8d3088fad76e800f

  • SSDEEP

    196608:xq/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:xHC9Lkuew6t2oCO9Azj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe
    "C:\Users\Admin\AppData\Local\Temp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp" /SL5="$70056,7577497,68096,C:\Users\Admin\AppData\Local\Temp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:5040
        • C:\Program Files (x86)\PlayGIF\gifplayer.exe
          "C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i
          3⤵
          • Executes dropped EXE
          PID:2412
        • C:\Program Files (x86)\PlayGIF\gifplayer.exe
          "C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s
          3⤵
          • Executes dropped EXE
          PID:4204
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 11
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 11
            4⤵
              PID:2936

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\PlayGIF\gifplayer.exe

        Filesize

        1.4MB

        MD5

        0df5ae7d31189bca070f416939aabd7d

        SHA1

        69703079139d359103bf6e5c655bfadccda40a79

        SHA256

        62a4ee9b77ad187406574f7dfd008f4ffdcec6a7098277b7344675619584f08a

        SHA512

        f88a7d0ccc0a85af7024196cf2444e14408263dd470cffa733d8f65ba35b51d986e261e094438a14705fb9cf7dc0580e591331007e8edd07a4524baa25b007e9

      • C:\Program Files (x86)\PlayGIF\gifplayer.exe

        Filesize

        1.1MB

        MD5

        ee24f4d625de23700978d65863af9164

        SHA1

        09effc5d8ccc9949cda23450e29f0cc52d573957

        SHA256

        301585317ddec7a6f879a249d5cf2de034e7f4e30745691a0994608fc95de9ac

        SHA512

        630c911be16423ed8491c743993f1cc1f046fd56545733988a23922c2aa05f6a4da694f08afafc5281b5b7e74c1a320a94dd213880bbb67df18ae6ce11a98698

      • C:\Program Files (x86)\PlayGIF\gifplayer.exe

        Filesize

        533KB

        MD5

        e845af7523dc1830108e5ff194376082

        SHA1

        b403642fd73a5ec958c0270802dd44c18f760320

        SHA256

        d40be29551079587ec95f5b4c455ca98b56cfb93f48f3633f9c374f9126809eb

        SHA512

        7b966fa2236ad81c40360a7df13b049b8bec78c4b059b6c6143d2d2b3a82c3bbf7857a305910ff1eda3dc956951ea09c6579b4b53c13c83ae90b0411f62ade3d

      • C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp

        Filesize

        448KB

        MD5

        e2bbe2ff3a975baf7e2ed94b4760519a

        SHA1

        842fae703269a343986b7fb77cf0862dd404c62e

        SHA256

        5019563a037e4b6541aafc29c88af7500e8b7b3bf4e7dda726930ff1d6db9b05

        SHA512

        ba08082d2c5ee85fc8461482bf56a371736af709d30e493f37ee430a56d7cf01111a36645dc65350f426762cf29161bcfa00d632bdc2119326e6fe8e7404cf17

      • C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp

        Filesize

        332KB

        MD5

        64c62186ce90da672cc15c4e48ade66a

        SHA1

        19029284b805e7c52dd57e177132612a967cefe6

        SHA256

        dbd4abb988ece6e44a4c99ed12d1c49c3662c2ab9678e0961c0e152cce1c686c

        SHA512

        148b39600361d0340e3ac8d489360afdb7b52dbe63421453214dbb3f4f4136f4d9fd730dc34d59fef844d7822284a0b6fe784c9e94890ef2c317ba2d7fa22572

      • C:\Users\Admin\AppData\Local\Temp\is-IU6VM.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • C:\Users\Admin\AppData\Local\Temp\is-IU6VM.tmp\_isetup\_isdecmp.dll

        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

      • memory/2412-152-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/2412-151-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/2412-155-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4020-160-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4020-0-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4020-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

      • memory/4204-186-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-179-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-157-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-208-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-162-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-205-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-166-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-167-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-170-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-173-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-176-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-159-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-180-0x00000000007A0000-0x000000000083E000-memory.dmp

        Filesize

        632KB

      • memory/4204-181-0x00000000007A0000-0x000000000083E000-memory.dmp

        Filesize

        632KB

      • memory/4204-202-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-189-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-190-0x00000000007A0000-0x000000000083E000-memory.dmp

        Filesize

        632KB

      • memory/4204-193-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-196-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4204-199-0x0000000000400000-0x0000000000666000-memory.dmp

        Filesize

        2.4MB

      • memory/4408-13-0x0000000000690000-0x0000000000691000-memory.dmp

        Filesize

        4KB

      • memory/4408-163-0x0000000000690000-0x0000000000691000-memory.dmp

        Filesize

        4KB

      • memory/4408-161-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB