Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/12/2023, 14:37
General
-
Target
tuc3.exe
-
Size
7.2MB
-
MD5
a5c73f548d3ecf47fdbb6d2f5c3f93d8
-
SHA1
f5bec713ca192b58a310f0130a9f484ecd556db6
-
SHA256
a8c1ac9575fbacb880b46937828bcf41f54e7734a3871f5bbaa2ca5f704c913f
-
SHA512
8d5ab8cad1d90b6d137674946723a6586f100c3bf4000ae20e815cb771253f7f6810f83e3a2946a92c0bdf711fad1e3130d3307b34e9f73f08965fc0af2eedb3
-
SSDEEP
196608:ixm50EF70ZaWLZ97vnC8LpS7+bI9cpSzj:8Et0Zak7aIA7kSzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exe"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MTGDU.tmp\tuc3.tmp"C:\Users\Admin\AppData\Local\Temp\is-MTGDU.tmp\tuc3.tmp" /SL5="$4014E,7257737,121856,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\numGIF\numgif.exe"C:\Program Files (x86)\numGIF\numgif.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 123⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 124⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD52359cb01f16c0e385014e5be4a2496dc
SHA121efe8fdb26f7a9be4e3da38e87705d21e80f16e
SHA25683f72f2a992c3bc896c33aa164ec329b807cee2591a6b8b50de94dd753e3ed1a
SHA5122da16f7ba8c1bfd7dfc98141013d66827f8ac812bf9db3b73c00049ab5a7b32dbe82d7ca3f6eca58893e5590f46cb8ce3943300f452753b772ae10ffe368385c
-
Filesize
100KB
MD5a9e9f9995433b5ecbf1104bc95bf2371
SHA1b6f9e7a61557a04d981c7f129ea63dc8ef0b5f90
SHA256768cfbc47557bf89714c566d239fd3aada5f576c20df43e253fd023afc86e635
SHA5120c4f21d96cac44c4ad754854d6c8cad0c7c2d1de10ad6ece0fdcdbd6f211abce180a65ea17c7b1d8409e8316b748a867a9797b270eae9d4b92ca9386cb926b47
-
Filesize
49KB
MD560884b909cdf786617b22e6ca2fbd12b
SHA15e6650b411b8709676cbdcbec3368bb8b505bcfb
SHA256b558104d86af32edbd90076d8556761cc71928366d0615f33a3d2d87a3ca59b1
SHA5127d2497f9c83b9c61e85ee7236ddb91ccda328c305fed7b77a0b4138369697371049fd26f207cc8830a25d3d4a67362ada66655cd775519a2079811fd956199e3
-
Filesize
342KB
MD5d438c1476509945f90fe70458b6d905b
SHA1576bd797a58b28a40490d438614d857352a0507b
SHA256c22c387f36b5b3ecbade01d992b2ba9de28d75ab0e9ae97bbfbafc860fbd353b
SHA5122de915be3cbe480b11b740ac615b3844e4e3ab4c30f78a8dade8c353139817fbdc8a513eaf095a930229e7e948531214ea87a902decd2bf692dcfb393ba0ea65
-
Filesize
319KB
MD51b9322e1b7d0cd5b10198d1b7bd0a3ab
SHA17a8d5323a587e72845c3ae7cdd17cf0959fd2bd7
SHA256b73c52a7dd931ab38abf89dc2ae65efbfb6c02d20627ca03b5223413983d53d1
SHA512618af962d39ce6235f646c987691c6943b040c6f271d859d69dc820bf38d8da7b0df50e6ffc7a3c44fb05396b5e078b1aaf86e3c3f1ce9a71d0b45784518ecff
-
Filesize
1.6MB
MD58419bbe752e4f8bbfc28850811e56d52
SHA1280216275235d8b6c0315d245f58deaadc88ce10
SHA25697496f3d00096ca921d220e10554b259853ee0ed1698ba5359cc28c4ddf3e833
SHA5123c2f53fb4dece9040e09ae5dea4cb9573d12bff344c230656f97633b54317f7203c42d2597190a541d58004acdc7bd64644c6fa1ed348572aad90e88f13042f2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
299KB
MD5add22dd2d4d2028dde80e2321fd05b1c
SHA16d7359e8f59b0ec77e8b38efe748c9d5a784d4dc
SHA256893c76126cd0889fcf8cfed0e90dfad35bbdbe331cc843ca4857f678aad1b52d
SHA512bfd059dce6206ec164f7a35901258684527d360229d9acccc0030df6cde426819b3b9644116a0dff58720a4b7831c18c82ca578dcc2e2bec8d68b396ff80c412
-
Filesize
4KB
-
Filesize
2.2MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.2MB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB