Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
0457c6bf851f140d591f32f097b16fb0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0457c6bf851f140d591f32f097b16fb0.exe
Resource
win10v2004-20231215-en
General
-
Target
0457c6bf851f140d591f32f097b16fb0.exe
-
Size
1000KB
-
MD5
0457c6bf851f140d591f32f097b16fb0
-
SHA1
cf6923e31dcc7c0f0f8f9d3cf3cf81cc7dbeadbc
-
SHA256
5c02382b53999a9ea66b632e708a717077cf0c2cb2023698d3c29e83d6324a00
-
SHA512
c6356e103b06877c38134892c4e11312b3e278c91fbe4fc3702ccaa7cd7b9e0493f9be41dc0ed64d89d0a140e1f630892a35ee695b55f7e5e17e2540b44c0759
-
SSDEEP
24576:ExNmN2yYuQQXEJp6Z0U1uyjeZC1B+5vMiqt0gj2ed:E5y1NXGIZfqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2952 0457c6bf851f140d591f32f097b16fb0.exe -
Executes dropped EXE 1 IoCs
pid Process 2952 0457c6bf851f140d591f32f097b16fb0.exe -
Loads dropped DLL 1 IoCs
pid Process 2220 0457c6bf851f140d591f32f097b16fb0.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2952 0457c6bf851f140d591f32f097b16fb0.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2952 0457c6bf851f140d591f32f097b16fb0.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2220 0457c6bf851f140d591f32f097b16fb0.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2220 0457c6bf851f140d591f32f097b16fb0.exe 2952 0457c6bf851f140d591f32f097b16fb0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2952 2220 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 2220 wrote to memory of 2952 2220 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 2220 wrote to memory of 2952 2220 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 2220 wrote to memory of 2952 2220 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 2952 wrote to memory of 1680 2952 0457c6bf851f140d591f32f097b16fb0.exe 16 PID 2952 wrote to memory of 1680 2952 0457c6bf851f140d591f32f097b16fb0.exe 16 PID 2952 wrote to memory of 1680 2952 0457c6bf851f140d591f32f097b16fb0.exe 16 PID 2952 wrote to memory of 1680 2952 0457c6bf851f140d591f32f097b16fb0.exe 16
Processes
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:1680
-
C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exeC:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2952
-
C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe"C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD5e48e2011c604ece1f304eae0c1277862
SHA150548f90a1e717c0048c86091eeb0e32d33168e4
SHA256520404a9b8f767a86911ca8cea31aedff0fd5da58afcb4b7bcbf29d067c4807c
SHA512cf1e2c47c2e346762a3d1beff977e2a879e264cd6beee8293e826410d641fc79bcafd0c6c2b099eadb0788228334157bd35006a631da30b133b213e4af5f1314