Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3CSharpDisc...ET.dll
windows10-2004-x64
1Google Chr...te.exe
windows10-2004-x64
7Newtonsoft.Json.dll
windows10-2004-x64
1System Run...or.exe
windows10-2004-x64
1System Run...or.exe
windows10-2004-x64
7System Run...or.pdb
windows10-2004-x64
3System Run...g.json
windows10-2004-x64
3clretwrc.dll
windows10-2004-x64
1clrjit.dll
windows10-2004-x64
1coreclr.dll
windows10-2004-x64
1createdump.exe
windows10-2004-x64
1dbgshim.dll
windows10-2004-x64
1hostfxr.dll
windows10-2004-x64
1hostpolicy.dll
windows10-2004-x64
1Analysis
-
max time kernel
105s -
max time network
267s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2023, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
CSharpDiscordWebhook.NET.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral2
Sample
Google Chrome Update.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
System Runtime Monitor.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
System Runtime Monitor.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
System Runtime Monitor.pdb
Resource
win10v2004-20231025-en
Behavioral task
behavioral7
Sample
System Runtime Monitor.runtimeconfig.json
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
clretwrc.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
clrjit.dll
Resource
win10v2004-20231025-en
Behavioral task
behavioral10
Sample
coreclr.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
createdump.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
dbgshim.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
hostfxr.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
hostpolicy.dll
Resource
win10v2004-20231023-en
General
-
Target
Google Chrome Update.exe
-
Size
9.0MB
-
MD5
87d78602fff2ef76fc4fdb949b94736a
-
SHA1
6c38327cdeb03b849a6743bf0e32d3c75ca5e318
-
SHA256
800f0f4c3cc2ba2195d8b527eba6a6a5b76f9aff55a6022814829ff00d433a8f
-
SHA512
d682e082631eb4f4036501106b8687eb30a7d4119326eb62832548ba20078c65acf53821db1181ee72c593bea1bbd1175b19c439c7cc65323ec6ebbaf128354a
-
SSDEEP
98304:s5TPERvFtw3WiikBkkkkk0p+GWmrZ+s5OhVvbj08DjGljYukqFgsJ:s5j33WOlWmh5OhVjHGK4g
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Google Chrome Update.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 60 api.ipify.org 62 ipinfo.io 59 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4896 powershell.exe 3124 powershell.exe 4896 powershell.exe 3124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1912 Google Chrome Update.exe Token: SeDebugPrivilege 4896 powershell.exe Token: SeDebugPrivilege 3124 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 3124 1912 Google Chrome Update.exe 85 PID 1912 wrote to memory of 3124 1912 Google Chrome Update.exe 85 PID 1912 wrote to memory of 4896 1912 Google Chrome Update.exe 86 PID 1912 wrote to memory of 4896 1912 Google Chrome Update.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Google Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Google Chrome Update.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Applications\Runtime Broker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82