Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 18:40
General
-
Target
41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa.exe
-
Size
7.5MB
-
MD5
6457f2b9bb8ae4dcb2ad691c082f5ad9
-
SHA1
d6ea42e9bb28e921d10775909be015848ff4da84
-
SHA256
41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa
-
SHA512
a7e79e886dd2b07d72950ba591a1248fca9945eaeaf871576afbd4b423f7e19ddd9c963246b8ca18fb388586e85d29317fafecc7eb9c70bb8a0b52f86c447145
-
SSDEEP
196608:9Wc5A2XV/1qTZGgnkphp0rAwZYGespRHDfY5cdV4qCzj:xDFyOTpBsLp1c5SV4qCzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa.exe"C:\Users\Admin\AppData\Local\Temp\41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2N1CE.tmp\41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa.tmp"C:\Users\Admin\AppData\Local\Temp\is-2N1CE.tmp\41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa.tmp" /SL5="$601B8,7612629,68096,C:\Users\Admin\AppData\Local\Temp\41b6e59e3bc2fb718292e9a68acc10697348242e8b7408f1af405b3e474691fa.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
594KB
MD544621a44eb67f701eece5c56b6f2d6d7
SHA1afa3e83e1038cce3eb9d8f2cb3e9550e65645858
SHA2567656f92dd17237a713f8c0b299d18bc4b9a95ddb4c0c9c7646a75692b1bd6a01
SHA5122d6629d3d18dbfce4258c0c1974c57a97bb755b83f52db3c7ab8dc7afa3aa5ed6127d9f9e417819ac9cee408c8e9e687a7049215b71813fef914979670c24fe7
-
Filesize
1.3MB
MD552e4e393d8d9c38a10ec63ba357a65f7
SHA13572ed19fd1eb186f230060237f3b97763a98a89
SHA25635ec7d4f3100d00836d881fd45b98fbb6070c9261c0584d21802ca83954dd21a
SHA512cc139c8a3750387b538dd6b36e1ad189bf582486b0e9f30fde42bc091b70a6f588ae4cb7bb5afc01d6e5a312d05b7d804f80691c587a0225795d4c3fb77f3de7
-
Filesize
170KB
MD56280d90f930fae00cc896f2056d6b731
SHA1c93fc5244f0bbbb84d95c32931f738e7a2262c50
SHA2562d5d99865b1f7a89a119558df4c2a92a9ae0d00ed21cc7deeb2437f58160010b
SHA5125fc73cca66b075b2c93eb5adf224b5854085714727d4d5981959d7815c76ae20fe98891fe3a8021515a19031d2855bc8cda064aa8235fe3bc861fef666c0fd5b
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB