Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
302s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
01/01/2024, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe
Resource
win10-20231215-en
General
-
Target
75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe
-
Size
6.5MB
-
MD5
298ac722674ea9191726a3056f2aa7e9
-
SHA1
bb25fac73d2f60170b7c054e97971384d547b985
-
SHA256
75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47
-
SHA512
efcd3b093004153ce52876ee7f87b8faf2725c141b82a3012520e1a57dfaf0c424161dbf010c44a6b37edc3e6dc6ef276015db63f45c0ed4a7967ce8b5aa12ae
-
SSDEEP
196608:8wT4OknrwAklnH74yKYhm5wRrcV7/jvrKS4dD:8e9ewAkd3r+7/jvEdD
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 2156 dbviewer.exe 4460 dbviewer.exe -
Loads dropped DLL 3 IoCs
pid Process 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 59 IoCs
description ioc Process File created C:\Program Files (x86)\DBViewerAPI\unins000.dat 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-IO93U.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-ISUDQ.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-CICT0.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-T1MDS.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-A3VR9.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-G13KA.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-VTSI9.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\lessmsi\is-6JN5G.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\stuff\is-LRLAD.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-NGC9Q.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-0NLBK.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-UEFSI.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-C5RPG.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-BU2R8.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-GIPPU.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-IJV3A.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\plugins\internal\is-IMHPP.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-7Q93H.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\stuff\is-DMH4N.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-G0N71.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-1CTRO.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\stuff\is-GD2J8.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-OA42S.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-A7EA5.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-UBSEG.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-PAT44.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-9GFFS.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-NK4UP.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-EOAI1.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-67TSA.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-N08RM.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-948QO.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-DNO7I.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-2FCBO.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-SM32R.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-L4H0N.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\is-5SKP5.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-3LLV7.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-GMA0A.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-7QS68.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-NGBOM.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-9J5CS.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\is-2P2H4.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-PU8BQ.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-JLSLC.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-QFUD2.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-VR6HF.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File opened for modification C:\Program Files (x86)\DBViewerAPI\unins000.dat 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File opened for modification C:\Program Files (x86)\DBViewerAPI\dbviewer.exe 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-3I1I4.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-84V4L.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-JJJ2V.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-0NFAC.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-141JS.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\plugins\internal\is-82TPH.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-SKONE.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\bin\x86\is-HTJKA.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp File created C:\Program Files (x86)\DBViewerAPI\stuff\is-0EUM8.tmp 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3476 wrote to memory of 3064 3476 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe 72 PID 3476 wrote to memory of 3064 3476 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe 72 PID 3476 wrote to memory of 3064 3476 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe 72 PID 3064 wrote to memory of 1228 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 73 PID 3064 wrote to memory of 1228 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 73 PID 3064 wrote to memory of 1228 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 73 PID 3064 wrote to memory of 2156 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 75 PID 3064 wrote to memory of 2156 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 75 PID 3064 wrote to memory of 2156 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 75 PID 1228 wrote to memory of 3684 1228 net.exe 76 PID 1228 wrote to memory of 3684 1228 net.exe 76 PID 1228 wrote to memory of 3684 1228 net.exe 76 PID 3064 wrote to memory of 4460 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 77 PID 3064 wrote to memory of 4460 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 77 PID 3064 wrote to memory of 4460 3064 75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe"C:\Users\Admin\AppData\Local\Temp\75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\is-TS8GJ.tmp\75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp"C:\Users\Admin\AppData\Local\Temp\is-TS8GJ.tmp\75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp" /SL5="$A01E0,6525984,419840,C:\Users\Admin\AppData\Local\Temp\75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 253⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 254⤵PID:3684
-
-
-
C:\Program Files (x86)\DBViewerAPI\dbviewer.exe"C:\Program Files (x86)\DBViewerAPI\dbviewer.exe" -i3⤵
- Executes dropped EXE
PID:2156
-
-
C:\Program Files (x86)\DBViewerAPI\dbviewer.exe"C:\Program Files (x86)\DBViewerAPI\dbviewer.exe" -s3⤵
- Executes dropped EXE
PID:4460
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f7b145a9b37fcb3cc0f4132b634ab442
SHA1eda226392ef39a394dbcc0a6b909e75ec7365240
SHA256a98f3334e308dd7fb39ca39cfadcbb9d1bf77ed370f9ecabe76a8b53e67a8a9b
SHA512df8841d8dcfe87989b428be8de0dc9ec2c080661afc14a1a5d09bd853a8549e9cea5acba4514fd523dc0f8833916af550c2ed92d6a5d9cbba3ea6a3ccf6d1991
-
Filesize
659KB
MD577f473f7e72b71dc3eb9bed1781a1b89
SHA1b9e276f10ebe5e302562dcecf1699a4eb7ae85da
SHA256bc795c491b0b85b85b4089f2bdb5439cfe09b38685fde92ae00add5dc645605c
SHA5124e7c7ade0fa090cda2711bcd602bafae2610bbdd987dc72617ee2bb36534e5504ae0b6bcd5bfc7eb1f7a75d6411b2a90cf6621df8a5c1f57d4d81d52ee277194
-
Filesize
425KB
MD52c1b3b42f6883098447d91bb27d4f34e
SHA16b90ecfe82b92ba99a8f78df267195602201a4ff
SHA2565f8aa0486376fee28dc67fb654e6d7aeaf8b7abe135624c559415e1f4d388842
SHA5127df3b2a6866a70141ceb3d288743064be4210646e3e6dba834759a5c69c572266a47c8d80947d45c6a3e4b9b02f0f8985331e8345feec78b8a23566fd8973908
-
C:\Users\Admin\AppData\Local\Temp\is-TS8GJ.tmp\75ddaa0967f886b93e6db8bf2ae1d969a6bff280627d3e6226fd45f22bed2a47.tmp
Filesize688KB
MD5a7662827ecaeb4fc68334f6b8791b917
SHA1f93151dd228d680aa2910280e51f0a84d0cad105
SHA25605f159722d6905719d2d6f340981a293f40ab8a0d2d4a282c948066809d4af6d
SHA512e9880b3f3ec9201e59114850e9c570d0ad6d3b0e04c60929a03cf983c62c505fcb6bb9dc3adeee88c78d43bd484159626b4a2f000a34b8883164c263f21e6f4a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303