Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
261s -
max time network
177s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
02/01/2023, 22:17
General
-
Target
3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe
-
Size
6.0MB
-
MD5
42979249e85a0ef1f6c0e4e7a2ab8b13
-
SHA1
65159abf134bc0578e6bee9efa67cef63fee6199
-
SHA256
3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b
-
SHA512
50ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf
-
SSDEEP
98304:9+G5NKbORL0dqUFFKtm3AhVOyTUATEPhsCf0z1ZMdxE5ofgK/tSaZkLCGYVXVfp:AGiqRhpQAaC+xE5IH/LZuCnf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe"C:\Users\Admin\AppData\Local\Temp\3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 5682⤵
- Program crash
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD542979249e85a0ef1f6c0e4e7a2ab8b13
SHA165159abf134bc0578e6bee9efa67cef63fee6199
SHA2563557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b
SHA51250ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf
-
Filesize
6.0MB
MD542979249e85a0ef1f6c0e4e7a2ab8b13
SHA165159abf134bc0578e6bee9efa67cef63fee6199
SHA2563557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b
SHA51250ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
9.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
9.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
9.4MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB