Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
268s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/09/2022, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe
Resource
win10-20220901-en
General
-
Target
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe
-
Size
2.6MB
-
MD5
5cc869a817b715c159ead8fbf935f605
-
SHA1
bfd3ab07cf3d6fbd65919526c8324d5e16955621
-
SHA256
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9
-
SHA512
516044436ddc83a4ef24eaffaabdd309b3687effe3a223043a4774266814bb82ef72bf183711eb979ce6845700c7bfaaddd22405fbb1ed1c22070e0c46c3d39b
-
SSDEEP
49152:iQ8Jt0z6z2bgJvzNY4Wax5syo1gKflMNCs7hxLeKP0Vnuctqb6y2WDtEElK:iPJt0O2bgv361x6tLcUuy2g3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1120 mqbkup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 1120 mqbkup.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1520 1460 WerFault.exe 17 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1204 schtasks.exe 596 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 1120 mqbkup.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1204 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 29 PID 1460 wrote to memory of 1204 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 29 PID 1460 wrote to memory of 1204 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 29 PID 1460 wrote to memory of 1204 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 29 PID 1460 wrote to memory of 872 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 34 PID 1460 wrote to memory of 872 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 34 PID 1460 wrote to memory of 872 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 34 PID 1460 wrote to memory of 872 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 34 PID 1460 wrote to memory of 1520 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 32 PID 1460 wrote to memory of 1520 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 32 PID 1460 wrote to memory of 1520 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 32 PID 1460 wrote to memory of 1520 1460 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 32 PID 2012 wrote to memory of 1120 2012 taskeng.exe 36 PID 2012 wrote to memory of 1120 2012 taskeng.exe 36 PID 2012 wrote to memory of 1120 2012 taskeng.exe 36 PID 2012 wrote to memory of 1120 2012 taskeng.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe"C:\Users\Admin\AppData\Local\Temp\c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"2⤵
- Creates scheduled task(s)
PID:1204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 4002⤵
- Program crash
PID:1520
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\67765327532705345647"2⤵
- Creates scheduled task(s)
PID:596
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}"2⤵PID:872
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {69C35635-69EC-4046-A0A7-1FC7C0E3B97C} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1120
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD55cc869a817b715c159ead8fbf935f605
SHA1bfd3ab07cf3d6fbd65919526c8324d5e16955621
SHA256c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9
SHA512516044436ddc83a4ef24eaffaabdd309b3687effe3a223043a4774266814bb82ef72bf183711eb979ce6845700c7bfaaddd22405fbb1ed1c22070e0c46c3d39b
-
Filesize
2.6MB
MD55cc869a817b715c159ead8fbf935f605
SHA1bfd3ab07cf3d6fbd65919526c8324d5e16955621
SHA256c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9
SHA512516044436ddc83a4ef24eaffaabdd309b3687effe3a223043a4774266814bb82ef72bf183711eb979ce6845700c7bfaaddd22405fbb1ed1c22070e0c46c3d39b