Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe
Resource
win10v2004-20230703-en
General
-
Target
9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe
-
Size
5.9MB
-
MD5
b419051e313f622bf30b2506412102dc
-
SHA1
439c1fb8eb772a60f11b0e782ca89e1acd67c83b
-
SHA256
9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f
-
SHA512
9338f4df8fdc8f64778d10a71d94a13e24e8d2ad79b0e613bc10d930c58dc672249e7ed6d131e28faf7d1d7a076be45a24b5dbf1db1839ff39a644c2928ae9e3
-
SSDEEP
98304:4GYNgZEX3Zewjl2r3teVZAl0V/wdfMXR5fbQsDyDUURBITrUWchB5py77PDs0/bb:4G9Zw34mArUZ0w84TksibyfP9b9XsTh8
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3500 created 1276 3500 9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe 64 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3500 9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe 3500 9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe 3500 9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe 3500 9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe 4792 powershell.exe 4792 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 4792 powershell.exe Token: SeIncreaseQuotaPrivilege 4792 powershell.exe Token: SeSecurityPrivilege 4792 powershell.exe Token: SeTakeOwnershipPrivilege 4792 powershell.exe Token: SeLoadDriverPrivilege 4792 powershell.exe Token: SeSystemProfilePrivilege 4792 powershell.exe Token: SeSystemtimePrivilege 4792 powershell.exe Token: SeProfSingleProcessPrivilege 4792 powershell.exe Token: SeIncBasePriorityPrivilege 4792 powershell.exe Token: SeCreatePagefilePrivilege 4792 powershell.exe Token: SeBackupPrivilege 4792 powershell.exe Token: SeRestorePrivilege 4792 powershell.exe Token: SeShutdownPrivilege 4792 powershell.exe Token: SeDebugPrivilege 4792 powershell.exe Token: SeSystemEnvironmentPrivilege 4792 powershell.exe Token: SeRemoteShutdownPrivilege 4792 powershell.exe Token: SeUndockPrivilege 4792 powershell.exe Token: SeManageVolumePrivilege 4792 powershell.exe Token: 33 4792 powershell.exe Token: 34 4792 powershell.exe Token: 35 4792 powershell.exe Token: 36 4792 powershell.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe"C:\Users\Admin\AppData\Local\Temp\9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vnlax#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:1244
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\9d82a6bf1c356fe0fe0081f3a71f2383ec8b0138528c2c6bcc8205dd4a50b55f.exe"2⤵PID:632
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵PID:456
-
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵PID:4940
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
448KB
MD5ed217887ccf87d6087e8cf42e1d75da1
SHA14a925c55e858a27ede3a5486a2147a74dcc18bff
SHA256a4a714c9cc7fc2d673765e50ba08ccd326a0b8c7f106491593296743fb163848
SHA512ecfede2607c961ae0c41725a706468885ba9c80cbda8b555ba8f85954d731f620fc7d6013fb7da60528f8cd98cfb4811437da9a6f4978fa7181fa3e96aa5b7b3