Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
2c7c53cc215cbc87b9d0fdd03a4a13ce.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2c7c53cc215cbc87b9d0fdd03a4a13ce.exe
Resource
win10v2004-20231215-en
General
-
Target
2c7c53cc215cbc87b9d0fdd03a4a13ce.exe
-
Size
4.8MB
-
MD5
2c7c53cc215cbc87b9d0fdd03a4a13ce
-
SHA1
ed49a3baf836e3c0c27cb1d575b48a2676e42b4f
-
SHA256
982de5fb844c74f708b0bcfff37b573614176cd311feebaa429ca0e5bb3550c5
-
SHA512
1ed85a115a200e31c3f286e4089a785c33d6265798eaf615188e8b89c8b45454c8579cc71a447552780b3bb2f3f3b4bb36a1567f9b0414520d73b4319e44516f
-
SSDEEP
98304:PX4kkWgiZ+zf/jghmMGqfvmP1/rO8ix0OhgJIXi49koyazx14:vZkWBZ+/gcqHW1/LPO6JIXi49koya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp 1840 Magni.exe -
Loads dropped DLL 1 IoCs
pid Process 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\Quas\unins000.dat 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\aut\is-F78MI.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\aut\is-QMI0L.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-NMRE1.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-M6PAG.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File opened for modification C:\Program Files (x86)\Quas\unins000.dat 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File opened for modification C:\Program Files (x86)\Quas\Magni.exe 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\aut\is-JPIAP.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\aut\is-428SN.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\aut\is-MD3JR.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\is-KMF1L.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-56A1F.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-85JG2.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-8Q200.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File opened for modification C:\Program Files (x86)\Quas\sqlite3.dll 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\is-A65MN.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\is-OSB13.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\is-H0JR7.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-PUTAJ.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\is-BFET2.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\is-R092F.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\aut\is-H7DUT.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp File created C:\Program Files (x86)\Quas\qui\is-TA5DF.tmp 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1200 wrote to memory of 232 1200 2c7c53cc215cbc87b9d0fdd03a4a13ce.exe 18 PID 1200 wrote to memory of 232 1200 2c7c53cc215cbc87b9d0fdd03a4a13ce.exe 18 PID 1200 wrote to memory of 232 1200 2c7c53cc215cbc87b9d0fdd03a4a13ce.exe 18 PID 232 wrote to memory of 1840 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp 27 PID 232 wrote to memory of 1840 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp 27 PID 232 wrote to memory of 1840 232 2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7c53cc215cbc87b9d0fdd03a4a13ce.exe"C:\Users\Admin\AppData\Local\Temp\2c7c53cc215cbc87b9d0fdd03a4a13ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\is-25L3C.tmp\2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp"C:\Users\Admin\AppData\Local\Temp\is-25L3C.tmp\2c7c53cc215cbc87b9d0fdd03a4a13ce.tmp" /SL5="$130028,4341601,721408,C:\Users\Admin\AppData\Local\Temp\2c7c53cc215cbc87b9d0fdd03a4a13ce.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Program Files (x86)\Quas\Magni.exe"C:\Program Files (x86)\Quas/\Magni.exe" 4dfbcb6392e4e82dec956a1f358df8ce3⤵
- Executes dropped EXE
PID:1840
-
-