Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
3abaf7302682abb2c7d851a7f9f600b3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3abaf7302682abb2c7d851a7f9f600b3.exe
Resource
win10v2004-20231215-en
General
-
Target
3abaf7302682abb2c7d851a7f9f600b3.exe
-
Size
4.8MB
-
MD5
3abaf7302682abb2c7d851a7f9f600b3
-
SHA1
c6d1571fd40320dbd5322827fe9f1c4b25a73520
-
SHA256
382a040cad6beda3e363a0bc564f341bd92d3d3592175d449599ca877dab6ee9
-
SHA512
db11ca34134ff57237453a8f8f9dfdacd2a9a808bba45bfd083252099e63b8377181eb64b0035fb8be6e098c7bb6f7114d2bb7c1fee5163f32902daafb20bb3f
-
SSDEEP
98304:PX4Nwhsxua0GgTReHnDjBDYwSGWeIAAWC8yazx14:v8WsGRiF0wSigWya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp 3292 Qui.exe -
Loads dropped DLL 1 IoCs
pid Process 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 22 IoCs
description ioc Process File created C:\Program Files (x86)\Ut\is-KSDHQ.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-C4S1Q.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\rerum\is-DOUQD.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\rerum\is-R6MEH.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File opened for modification C:\Program Files (x86)\Ut\Qui.exe 3abaf7302682abb2c7d851a7f9f600b3.tmp File opened for modification C:\Program Files (x86)\Ut\sqlite3.dll 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-I4AP8.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\adipisci\is-G3TFD.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\rerum\is-KUQGR.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-5G0Q7.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-CIFB0.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\rerum\is-KCKOC.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\unins000.dat 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-0D4DV.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\adipisci\is-RGF21.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\adipisci\is-TOQFF.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\adipisci\is-98S23.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\rerum\is-5BQS7.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-EF6FE.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File opened for modification C:\Program Files (x86)\Ut\unins000.dat 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-MBUCI.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp File created C:\Program Files (x86)\Ut\is-07OHK.tmp 3abaf7302682abb2c7d851a7f9f600b3.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4768 4820 3abaf7302682abb2c7d851a7f9f600b3.exe 20 PID 4820 wrote to memory of 4768 4820 3abaf7302682abb2c7d851a7f9f600b3.exe 20 PID 4820 wrote to memory of 4768 4820 3abaf7302682abb2c7d851a7f9f600b3.exe 20 PID 4768 wrote to memory of 3292 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp 31 PID 4768 wrote to memory of 3292 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp 31 PID 4768 wrote to memory of 3292 4768 3abaf7302682abb2c7d851a7f9f600b3.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3abaf7302682abb2c7d851a7f9f600b3.exe"C:\Users\Admin\AppData\Local\Temp\3abaf7302682abb2c7d851a7f9f600b3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\is-967J4.tmp\3abaf7302682abb2c7d851a7f9f600b3.tmp"C:\Users\Admin\AppData\Local\Temp\is-967J4.tmp\3abaf7302682abb2c7d851a7f9f600b3.tmp" /SL5="$A0040,4315556,721408,C:\Users\Admin\AppData\Local\Temp\3abaf7302682abb2c7d851a7f9f600b3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Program Files (x86)\Ut\Qui.exe"C:\Program Files (x86)\Ut/\Qui.exe" af5733f5dbedd236941f32dcfc6054b33⤵
- Executes dropped EXE
PID:3292
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5636dac01e993b7933bd563bd8d2215e2
SHA12510b6336bd5bf2e1eef681133d82bf25733418a
SHA25612a176f9601f23c1523f8193cd93e84033585d76708f2c3d9379ca7954a7685c
SHA5122e943c783ca737cda38b608025be63d8ee21e7cef9ae37ffab8124a4669b572f5056bdc9e13a3d85fe45a1443283b52d3acf46f4682f8cd267b304244aa1a483
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63