Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe
Resource
win10v2004-20231130-en
General
-
Target
17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe
-
Size
7.5MB
-
MD5
b8c7b93dd33d87b85c054b520c31ba61
-
SHA1
9e49fd71f89ca26afb70fdc50ecb081e8c89ff7b
-
SHA256
17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257
-
SHA512
8142d54e1a6bd105c0ec9d3ecab068ba629ac4e8ff19fd6aaec1f89ce07cae5925a1f76fa5cfdb0ec5eda7d4585c77e819b51301966d82cd174fbfbc3835260a
-
SSDEEP
196608:tpVDDR8SZqepbLqwjKpDf/NIpEpDqfBrT0/WViLFfzj:tpVBtvpbL/+vVYBrTTefzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 1556 gifplayer.exe 4116 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 194.49.94.194 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\bin\x86\is-HB7I4.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-GMIIQ.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-93QGA.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-51NRF.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-I82DE.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PLV92.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PQFPI.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8NOCB.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2TF72.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-O0C49.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-6N5L4.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FRG04.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-20VGP.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-RPM9B.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CRS3H.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-D1AN2.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1H8E7.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ISJ41.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2N3HR.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-96Q26.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MJTBJ.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EK7GP.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9PQGD.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-SV8EC.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4L2PR.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-M2AHK.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BVDM7.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NCAA8.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7VL8U.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-6NSPU.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FD504.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BDFFN.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IO0JI.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8P499.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ENM33.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-M5MO4.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NB94R.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CINDA.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4QFS4.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UMS6A.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-E9NSM.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\is-MM8VA.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-DG2JC.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-6DGT5.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DJA92.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FMMKB.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-79UJE.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-78INR.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MRT83.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MFF7P.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-QDFG1.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-BDT7A.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9D5A8.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5KJ03.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PV6U3.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DDNVU.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-CFC84.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-A95UU.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-J14PR.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-FOJ7H.tmp 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1860 2160 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe 87 PID 2160 wrote to memory of 1860 2160 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe 87 PID 2160 wrote to memory of 1860 2160 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe 87 PID 1860 wrote to memory of 1616 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 91 PID 1860 wrote to memory of 1616 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 91 PID 1860 wrote to memory of 1616 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 91 PID 1860 wrote to memory of 1556 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 93 PID 1860 wrote to memory of 1556 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 93 PID 1860 wrote to memory of 1556 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 93 PID 1860 wrote to memory of 3756 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 96 PID 1860 wrote to memory of 3756 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 96 PID 1860 wrote to memory of 3756 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 96 PID 1860 wrote to memory of 4116 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 95 PID 1860 wrote to memory of 4116 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 95 PID 1860 wrote to memory of 4116 1860 17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp 95 PID 3756 wrote to memory of 4872 3756 net.exe 97 PID 3756 wrote to memory of 4872 3756 net.exe 97 PID 3756 wrote to memory of 4872 3756 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe"C:\Users\Admin\AppData\Local\Temp\17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\is-PAIEF.tmp\17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp"C:\Users\Admin\AppData\Local\Temp\is-PAIEF.tmp\17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp" /SL5="$80068,7565670,68096,C:\Users\Admin\AppData\Local\Temp\17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1616
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:1556
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:4116
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:4872
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50ce3eee85150e103e1e0698ed8a6491c
SHA1e3c1cf211916c046b8ea97465234861a63597e63
SHA256882ff73a98473d5ef4231f8087af4c336ab558cf17d16c2ce6d762029c5a470a
SHA512ba85bc6aeedcb455c3e10f9622c4525934143d810fff12b2a8011e19480e0dc6e6d7066e72643d63f55a0fa014a4be3aeb814c88da09796cb5462af93cebbafd
-
Filesize
1.9MB
MD57da1b411e014d5b9d3b9a527e0c08e32
SHA1b559314bf2b664e9daf4e89cf164bb975f55eb10
SHA25659aead1a63e7cbfb27315f92e7cd9844979f4e9d5571f85e6b24be29b052e07c
SHA51295a23deed657b0f6b08d206811cc4a52ac5c7d10f48e368505c5c0854720fb514e4808315ef18a3a4fd8ce2c6e5f21738c9a04c77fdae2c3ac4acd341fad8e3d
-
Filesize
288KB
MD5c3041ffdddf4c023251368f3f116a470
SHA1b93864fb2fb7d8d08129c7c34f5e5a84b9bc8741
SHA2563f92fd3e1c0689ab14abc0e92fb4e99b50776b93af623b0f94eade4729b678cb
SHA512f26914eaf3b6ae47db9675c84a3b4222e9a54278d75b7dad69a1441781f483f4ad167757ef526ff56dc9cd7fa7dacfcad05c7cb8be9199813320e82c244f8614
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-PAIEF.tmp\17a4dcefaef322cb38c076d1f725223035941c58413fe6ba4d02edf66156b257.tmp
Filesize687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4