Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
134s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe
Resource
win10-20231023-en
General
-
Target
648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe
-
Size
7.5MB
-
MD5
b042e95b3cc081e4f718860e824fe8d2
-
SHA1
3a3153dd319d6f226844536dfe33acb15d083821
-
SHA256
648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033
-
SHA512
28b84f2006f580d760bb51cba5345792f198d827c3778886a955615836592b69f0c10643bf9bb3ec4416b9646b66a4d7daa9419410422eb9863a86127b89c24f
-
SSDEEP
196608:wq/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:wHC9Lkuew6t2oCO9Azj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 4080 gifplayer.exe 4824 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UPE5T.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-K5K6G.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-V4Q6C.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-TKG98.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IOEA6.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-F1AQU.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PEQ1L.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1O3IH.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-UTTCP.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-DUVDV.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-QMEDC.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2NQVT.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-24SL4.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LLRSG.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-AGP1R.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-A1D5B.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8NMBJ.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-MKFIA.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-TO444.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-TO3SA.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7JA7S.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-VL963.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-KT3PR.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PC17G.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MT8TE.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NCNGO.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2UE9S.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BP6S4.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BTHLB.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-R9H64.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5U2C6.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-AC70D.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4OQP5.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-I1SET.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9DNQG.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-22SVL.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ICTQG.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4823S.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7SOEC.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-6NB7E.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-BKC0E.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IGN3D.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-HQ01F.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FVGV5.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-HT1PS.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-92OU5.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-Q6DKH.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-S23HR.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-J26OU.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-Q41Q3.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PP8DD.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-31KQT.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-G74CB.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7J6VH.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\is-9TM7H.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-3BMME.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-D8KL4.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PQQUL.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-AH05S.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FJR5G.tmp 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 404 wrote to memory of 3340 404 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe 71 PID 404 wrote to memory of 3340 404 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe 71 PID 404 wrote to memory of 3340 404 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe 71 PID 3340 wrote to memory of 2172 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 72 PID 3340 wrote to memory of 2172 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 72 PID 3340 wrote to memory of 2172 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 72 PID 3340 wrote to memory of 4080 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 74 PID 3340 wrote to memory of 4080 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 74 PID 3340 wrote to memory of 4080 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 74 PID 3340 wrote to memory of 304 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 77 PID 3340 wrote to memory of 304 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 77 PID 3340 wrote to memory of 304 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 77 PID 3340 wrote to memory of 4824 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 76 PID 3340 wrote to memory of 4824 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 76 PID 3340 wrote to memory of 4824 3340 648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp 76 PID 304 wrote to memory of 2496 304 net.exe 78 PID 304 wrote to memory of 2496 304 net.exe 78 PID 304 wrote to memory of 2496 304 net.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe"C:\Users\Admin\AppData\Local\Temp\648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\is-ORQ4G.tmp\648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp"C:\Users\Admin\AppData\Local\Temp\is-ORQ4G.tmp\648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp" /SL5="$90050,7577497,68096,C:\Users\Admin\AppData\Local\Temp\648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2172
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:4080
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:4824
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:2496
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
543KB
MD5a40261d654634efaaf657ecd4d770f88
SHA1684cde0ae2440a76eb87c38a8af55934e2bcb0fe
SHA256cf7ef9faa538e5681d45a3debe619000ca7bb930b1e69472bbb14fbcf6d471f2
SHA512e8b33d03d0665012f381c616d10d2d2fc76860e1b70c060d597f34c245115fcb9390cc0eddaeaf28be3cffb3bcd017efaa7d7409788f95912304c98575cb4ed9
-
Filesize
512KB
MD558ea0a83e9f2de09c84b5ed03c09fe51
SHA10f6be5e7de2ad01f09b6b10dfe0018dbbe77ae62
SHA256448362785a5bba9f1d400a90a0f2ea95a7ff8136661817c0d81486e72847d0af
SHA5127b262a16342c6af6bee1ff78130e2bef993fe44b614708e3329be9ab666d1af737a6ac64ad3b0044dc3737e381984b11aae7b6350313584915d2c3f40efb329f
-
Filesize
2.3MB
MD5cd47a27efec498c39223b8123518b599
SHA164212552a6b0ac1e591d175daf6db231593dcf06
SHA256450692897c81b9ccef47ecb65a8657fcfdd0930335104e52d42f1cbed44f078b
SHA5126dd45bf0f968f10d634042676414944b831d0063214611b1a78d40c8b2b9bff5780b13c7c03ea1c00ebda22e1a8c8ba1098babbc0b1f12e2433efa84f081bfa4
-
C:\Users\Admin\AppData\Local\Temp\is-ORQ4G.tmp\648c9d51835da631f5f103998ca66dd97ca4e8357606bc813d2b987823ee9033.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303