Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 16:03
Behavioral task
behavioral1
Sample
UMS_Installer.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
UMS_Installer.exe
Resource
win10v2004-20240802-en
General
-
Target
UMS_Installer.exe
-
Size
10.1MB
-
MD5
004bd0f4842c4c5534d72e22980b9418
-
SHA1
cfca0f182a54deab02d9ed0cfc373a77600fa25d
-
SHA256
923714d07749abc21817024df65460188a1371e5b6785761a791f6788510d871
-
SHA512
57be554cd37495f1fdcc11e63fce0b1a5ba2f10022144c3073061f76ebc4a2492ec81e84f68b723f9a8873d968e29a2f5d837e0ed2532b809b315e2a805c8bb2
-
SSDEEP
196608:VASH+aCTr7PnILLZWdoCOisL2Vmd6+DZTNfwZHYYerltvVUL3x:Veagr7M5lisL2Vmd6mZBkGPvVU
Malware Config
Signatures
-
Loads dropped DLL 19 IoCs
pid Process 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe 5032 UMS_Installer.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1496 wrote to memory of 5032 1496 UMS_Installer.exe 86 PID 1496 wrote to memory of 5032 1496 UMS_Installer.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\UMS_Installer.exe"C:\Users\Admin\AppData\Local\Temp\UMS_Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\UMS_Installer.exe"C:\Users\Admin\AppData\Local\Temp\UMS_Installer.exe"2⤵
- Loads dropped DLL
PID:5032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
Filesize
801KB
MD5ee3d454883556a68920caaedefbc1f83
SHA145b4d62a6e7db022e52c6159eef17e9d58bec858
SHA256791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
SHA512e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6
-
Filesize
78KB
MD5d61719bf7f3d7cdebdf6c846c32ddaca
SHA1eda22e90e602c260834303bdf7a3c77ab38477d0
SHA25631dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb
SHA512e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f
-
Filesize
117KB
MD53fc444a146f7d667169dcb4f48760f49
SHA1350a1300abc33aa7ca077daba5a883878a3bca19
SHA256b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68
SHA5121609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8
-
Filesize
60KB
MD50d75220cf4691af4f97ebcbd9a481c62
SHA1dadc3d5476c83668a715750ed80176dbbb536ec7
SHA2569da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303
SHA512c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112
-
Filesize
151KB
MD5afff5db126034438405debadb4b38f08
SHA1fad8b25d9fe1c814ed307cdfddb5cd6fe778d364
SHA25675d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0
SHA5123334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc
-
Filesize
27KB
MD5c8a1f1dc297b6dd10c5f7bc64f907d38
SHA1be0913621e5ae8b04dd0c440ee3907da9cf6eb72
SHA256827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7
SHA512e5f07935248f8d57b1f61fe5de2105b1555c354dd8dd98f0cff21b08caba17b66272a093c185ca025edb503690ba81d5fa8b7443805a07338b25063e2f7ea1b1
-
Filesize
74KB
MD5f59ddb8b1eeac111d6a003f60e45b389
SHA1e4e411a10c0ad4896f8b8153b826214ed8fe3caa
SHA2569558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da
SHA512873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf
-
Filesize
153KB
MD580f2475d92ad805439d92cba6e657215
SHA120aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab
SHA25641278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79
SHA512618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5
-
Filesize
1.0MB
MD596a6862e0b21dea92b8397a5403b5f9e
SHA195932e2e11eef830a47e5789c70dadff7c43ddec
SHA25651710486ed9500cc84df46564596846ce802c95f11764763904751f82a98fb88
SHA51215847082ae174817c966e606583d3f27b7968aa0ec6a60cf9eddcde6f0a313d92611e12d017ac1a9b956a6889608ad9356839199bf9d5bebffd146b6183dcaf7
-
Filesize
283KB
MD5302b49c5f476c0ae35571430bb2e4aa0
SHA135a7837a3f1b960807bf46b1c95ec22792262846
SHA256cf9d37fa81407afe11dcc0d70fe602561422aa2344708c324e4504db8c6c5748
SHA5121345af52984b570b1ff223032575feb36cdfb4f38e75e0bd3b998bc46e9c646f7ac5c583d23a70460219299b9c04875ef672bf5a0d614618731df9b7a5637d0a
-
Filesize
3.3MB
MD5ab01c808bed8164133e5279595437d3d
SHA10f512756a8db22576ec2e20cf0cafec7786fb12b
SHA2569c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA5124043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
682KB
MD5de72697933d7673279fb85fd48d1a4dd
SHA1085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA5120fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c
-
Filesize
61KB
MD5704d647d6921dbd71d27692c5a92a5fa
SHA16f0552ce789dc512f183b565d9f6bf6bf86c229d
SHA256a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769
SHA5126b340d64c808388fe95e6d632027715fb5bd801f013debaaa97e5ecb27a6f6ace49bf23648517dd10734daff8f4f44969cff2276010bf7502e79417736a44ec4
-
Filesize
4.2MB
MD5e9c0fbc99d19eeedad137557f4a0ab21
SHA18945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
SHA2565783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
SHA51274e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
-
Filesize
26KB
MD5994a6348f53ceea82b540e2a35ca1312
SHA18d764190ed81fd29b554122c8d3ae6bf857e6e29
SHA256149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4
SHA512b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f
-
Filesize
994KB
MD58e7680a8d07c3c4159241d31caaf369c
SHA162fe2d4ae788ee3d19e041d81696555a6262f575
SHA25636cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA5129509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
-
Filesize
1.1MB
MD5c01a5ce36dd1c822749d8ade8a5e68ca
SHA1a021d11e1eb7a63078cbc3d3e3360d6f7e120976
SHA2560f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a
SHA5123d4e70a946f69633072a913fe86bada436d0c28aca322203aa5ec9d0d7ae111129516d7adb3fdeef6b1d30b50c86c1de2c23a1bc9fba388474b9d9131c1e5d38