Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
297s -
max time network
177s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
16/09/2022, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe
Resource
win10-20220901-en
General
-
Target
73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe
-
Size
2.7MB
-
MD5
03db63829881328d9dc41bea635ebcf1
-
SHA1
4ebbb4db5fdc2fe9abb67dc98a6d23cc8f2ddcd1
-
SHA256
73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1
-
SHA512
22554bc3527ad1d6350743f166b10836f18a731271ce4481498f127556b6242e06ebc0c244af47e54d07bdc539fda3776dc6ab6ad959416c1babf007b73c0a18
-
SSDEEP
49152:ZVd8tDA+e7Cpm4n1a2UuXYM2T/AtAMLDRpRPCkrXZ303cPWVMfTdOyu4:N8t3/1RXYpYDdzrJ03cOWfT8P4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4952 mqbkup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 4952 mqbkup.exe 4952 mqbkup.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2864 schtasks.exe 4496 schtasks.exe 4412 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 4952 mqbkup.exe 4952 mqbkup.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2864 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 67 PID 2652 wrote to memory of 2864 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 67 PID 2652 wrote to memory of 2864 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 67 PID 2652 wrote to memory of 4560 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 69 PID 2652 wrote to memory of 4560 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 69 PID 2652 wrote to memory of 4560 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 69 PID 2652 wrote to memory of 4496 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 71 PID 2652 wrote to memory of 4496 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 71 PID 2652 wrote to memory of 4496 2652 73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe 71 PID 4952 wrote to memory of 4412 4952 mqbkup.exe 75 PID 4952 wrote to memory of 4412 4952 mqbkup.exe 75 PID 4952 wrote to memory of 4412 4952 mqbkup.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe"C:\Users\Admin\AppData\Local\Temp\73d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"2⤵
- Creates scheduled task(s)
PID:2864
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}"2⤵PID:4560
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\67765327532705345647"2⤵
- Creates scheduled task(s)
PID:4496
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"2⤵
- Creates scheduled task(s)
PID:4412
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52f1e90ec805bc2353d78e1f2d2441202
SHA12ddd421f9ef3001558b2a2fccbecdb0d01d82233
SHA256f8fff0fc8378edef7c7cd664c360678c0d64c804fa2c4c6372c7f3126eb210d2
SHA512293d58142f7b12cdccbb916a2454262e76146c72f11c7b2b5bed7135efa073f47d241eeb321a932801ca0b3a6b96f994c9d3d9b25eb2706b43cb72cc0d510188
-
Filesize
2.7MB
MD503db63829881328d9dc41bea635ebcf1
SHA14ebbb4db5fdc2fe9abb67dc98a6d23cc8f2ddcd1
SHA25673d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1
SHA51222554bc3527ad1d6350743f166b10836f18a731271ce4481498f127556b6242e06ebc0c244af47e54d07bdc539fda3776dc6ab6ad959416c1babf007b73c0a18
-
Filesize
2.7MB
MD503db63829881328d9dc41bea635ebcf1
SHA14ebbb4db5fdc2fe9abb67dc98a6d23cc8f2ddcd1
SHA25673d6afecb6e66b60f99384379c9345514a2ef42196ce811e37eb6a389548c7f1
SHA51222554bc3527ad1d6350743f166b10836f18a731271ce4481498f127556b6242e06ebc0c244af47e54d07bdc539fda3776dc6ab6ad959416c1babf007b73c0a18