Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
04c7c20c7108d55e4eb2e3145dfb93e5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
04c7c20c7108d55e4eb2e3145dfb93e5.exe
Resource
win10v2004-20231222-en
General
-
Target
04c7c20c7108d55e4eb2e3145dfb93e5.exe
-
Size
506KB
-
MD5
04c7c20c7108d55e4eb2e3145dfb93e5
-
SHA1
f8edb3daad613a4688a3cf90e92a2543572d5b96
-
SHA256
988208f1bdf55940c24b7e09f0d4c2cc14c03b3bb4b8b2fe121a4f9ee615e3a6
-
SHA512
3f483bad33b890115dce7592f49d0df4361f2d68a8ad5b300cfdf068954dd0c32506f6ea9c8dd17b9ab078ba5498da28bc50d55f3c465784909eea40b9e779de
-
SSDEEP
12288:ylU9OgEsewHzYFvoYVIngS/RoRUHUBdDQNzuUQxrqxk0:b9uyzGAYVutHjyNYp
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe -
Executes dropped EXE 1 IoCs
pid Process 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2300 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3880 04c7c20c7108d55e4eb2e3145dfb93e5.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3880 04c7c20c7108d55e4eb2e3145dfb93e5.exe 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3880 wrote to memory of 3892 3880 04c7c20c7108d55e4eb2e3145dfb93e5.exe 17 PID 3880 wrote to memory of 3892 3880 04c7c20c7108d55e4eb2e3145dfb93e5.exe 17 PID 3880 wrote to memory of 3892 3880 04c7c20c7108d55e4eb2e3145dfb93e5.exe 17 PID 3892 wrote to memory of 2300 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe 35 PID 3892 wrote to memory of 2300 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe 35 PID 3892 wrote to memory of 2300 3892 04c7c20c7108d55e4eb2e3145dfb93e5.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe"C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exeC:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\04c7c20c7108d55e4eb2e3145dfb93e5.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2300
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d28801a65aae5298f8703ef0353a3885
SHA18dad82a1d71f6fff297c8e26e2aec0ac80ab3afe
SHA25617f2b3f4f9542f68d83b0cc8a0937737e398d764c7b918d61b2fe94560eec73a
SHA5125d4764cc139f871bed9151c16a5f42dfa60408a1261ff92d218c7db1fa64b76414832e655981a620e0de102c5866f66d656a11c42854736510e0eb8452d6dc11