Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
12/12/2023, 11:36
General
-
Target
5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c.exe
-
Size
7.2MB
-
MD5
2d0d0d08164aed08ab0571394f442b16
-
SHA1
0abebab9cc3d9f05f2816685e92cbf3b001e7a84
-
SHA256
5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c
-
SHA512
aa080515c07bd9d379ebac087b4dd07141fcbfbdde2f83b480a2db1d934a36487e7b17f25e2eea76ebe448d8f392115aa85cebb5f777ac148f53f32974aab325
-
SSDEEP
196608:6xm5nCZjZ3QO7Kmk85hry72SfDYuahd3u/w2lzj:XC80q8y72Skua3+/Vlzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c.exe"C:\Users\Admin\AppData\Local\Temp\5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IAJ66.tmp\5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c.tmp"C:\Users\Admin\AppData\Local\Temp\is-IAJ66.tmp\5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c.tmp" /SL5="$7021A,7251001,121856,C:\Users\Admin\AppData\Local\Temp\5d7f0934dacca748254d7a8c46ca75d7af2d521f5f666c7c7fe5018ee6ab725c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 123⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 124⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
614KB
MD5700435bf136dfe6e75d7baba5b4dc881
SHA1c9a85020771e27409adc42de092e1dee2841aa53
SHA2567d52e2830b2265b76f75a6785474786d462e7296d77e0b8f45fcb4408e70f012
SHA512e12238a9a889953546559ee287c96d796ab2860add966236099e609399a8e7defb53c6334f6b2efcdd21be3c2a8af77d910a5dc7e3e9bff1236b2640e2b1fca7
-
Filesize
858KB
MD5dc40aa84461a2e1482156eec66af5eec
SHA10b253387777ed5fe7d8589e52af1b5ba8d3bff4c
SHA256156facfcca1be7610fec16cac3a7d3f81696ce89d8015ab869f3b1f9d3837e71
SHA5126f752d31705a7c26ae7391247537d8e7f28c5f052887368337e857a6694b4b0b66b4005006d2a0fa0a64ae9b5be6f781bc9cb640b166a051dfc416d15b000999
-
Filesize
613KB
MD5a3b5918f30d37dc5b9e022a411fff907
SHA10ec77e3859030182d9b912c300f8b5b92fcb496b
SHA256e64e34ac57214bfe6a2743fdd2d469d1b6634bfc274772afa7597e220576b2bd
SHA5120aeb950018ffad6375dd2f8309dd040dde225f37511099a7a12f8969b89e76e81da7df7deb36bfd4e4e046d1e9dca700336d4b71f2f19fa0590b280627ccad4f
-
Filesize
356KB
MD50e9e6ce30716723325b8e7a4edcce779
SHA190a9d5920a1a76a1d6d33aa97824822240ea6ad3
SHA256f40dcd45c34107e76ed449e02508578704ab259c051f40bcc62a5eaff55631cd
SHA512f7c68e4d549071d564251e355dd7443825a208c08d7352ff55c9d5b8179d7e91bcea1ed271ec3e3239bdebeee1546f516317ef6c18bd0e1f2a5d86eb74023d91
-
Filesize
418KB
MD55b6f64e74378f3bd9dcb397d5b724618
SHA1ac55f6270d6d745a167d9f48f70d7136d25c80c5
SHA256b76bf2b9e46e4f463ecad822fc512d6e4a23e84fad8ab1a585ffe788f56e6741
SHA5125a80c2fc6750a39da99f6f73716cfab33393cfb4d813d596160daa5f847b8043b4d4297936b804b3065ddc60d3196b1d4dd98116488d50f44cf3f10e63e24959
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB