Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
21/09/2022, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe
Resource
win10-20220901-en
General
-
Target
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe
-
Size
2.6MB
-
MD5
5cc869a817b715c159ead8fbf935f605
-
SHA1
bfd3ab07cf3d6fbd65919526c8324d5e16955621
-
SHA256
c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9
-
SHA512
516044436ddc83a4ef24eaffaabdd309b3687effe3a223043a4774266814bb82ef72bf183711eb979ce6845700c7bfaaddd22405fbb1ed1c22070e0c46c3d39b
-
SSDEEP
49152:iQ8Jt0z6z2bgJvzNY4Wax5syo1gKflMNCs7hxLeKP0Vnuctqb6y2WDtEElK:iPJt0O2bgv361x6tLcUuy2g3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4252 mqbkup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 4252 mqbkup.exe 4252 mqbkup.exe 4252 mqbkup.exe 4252 mqbkup.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1996 schtasks.exe 3556 schtasks.exe 4552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 4252 mqbkup.exe 4252 mqbkup.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 520 wrote to memory of 1996 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 67 PID 520 wrote to memory of 1996 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 67 PID 520 wrote to memory of 1996 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 67 PID 520 wrote to memory of 4916 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 69 PID 520 wrote to memory of 4916 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 69 PID 520 wrote to memory of 4916 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 69 PID 520 wrote to memory of 3556 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 71 PID 520 wrote to memory of 3556 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 71 PID 520 wrote to memory of 3556 520 c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe 71 PID 4252 wrote to memory of 4552 4252 mqbkup.exe 75 PID 4252 wrote to memory of 4552 4252 mqbkup.exe 75 PID 4252 wrote to memory of 4552 4252 mqbkup.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe"C:\Users\Admin\AppData\Local\Temp\c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"2⤵
- Creates scheduled task(s)
PID:1996
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}"2⤵PID:4916
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\67765327532705345647"2⤵
- Creates scheduled task(s)
PID:3556
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Message Queuing Backup{J4G6S2B4M7X2-F6S2J7D9N5-H5D2A3X4V5}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\mqb\mqbkup.exe"2⤵
- Creates scheduled task(s)
PID:4552
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD507143eb5a43cd33ddf1d92f5ec90874b
SHA1bca2cadd54ff11dcf8a07177e42a4909c81e94fc
SHA25605291ee4ee982ca893b0fba0cdbeafee5b08dcf1642099814783f714ad7a28de
SHA512b8b7394ff9047d8e17f2dd68a529436bf0047f5bb009e47a658f0ed3375fe3ec455a889d407ad48ba22007894f106a97758090aa0fdaf25e3153be1cbe50e35f
-
Filesize
2.6MB
MD55cc869a817b715c159ead8fbf935f605
SHA1bfd3ab07cf3d6fbd65919526c8324d5e16955621
SHA256c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9
SHA512516044436ddc83a4ef24eaffaabdd309b3687effe3a223043a4774266814bb82ef72bf183711eb979ce6845700c7bfaaddd22405fbb1ed1c22070e0c46c3d39b
-
Filesize
2.6MB
MD55cc869a817b715c159ead8fbf935f605
SHA1bfd3ab07cf3d6fbd65919526c8324d5e16955621
SHA256c5a789a1439ceefd9990f60b91999b1187267eb1709a224ae687bed8463a3aa9
SHA512516044436ddc83a4ef24eaffaabdd309b3687effe3a223043a4774266814bb82ef72bf183711eb979ce6845700c7bfaaddd22405fbb1ed1c22070e0c46c3d39b