Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
0457c6bf851f140d591f32f097b16fb0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0457c6bf851f140d591f32f097b16fb0.exe
Resource
win10v2004-20231215-en
General
-
Target
0457c6bf851f140d591f32f097b16fb0.exe
-
Size
1000KB
-
MD5
0457c6bf851f140d591f32f097b16fb0
-
SHA1
cf6923e31dcc7c0f0f8f9d3cf3cf81cc7dbeadbc
-
SHA256
5c02382b53999a9ea66b632e708a717077cf0c2cb2023698d3c29e83d6324a00
-
SHA512
c6356e103b06877c38134892c4e11312b3e278c91fbe4fc3702ccaa7cd7b9e0493f9be41dc0ed64d89d0a140e1f630892a35ee695b55f7e5e17e2540b44c0759
-
SSDEEP
24576:ExNmN2yYuQQXEJp6Z0U1uyjeZC1B+5vMiqt0gj2ed:E5y1NXGIZfqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2696 0457c6bf851f140d591f32f097b16fb0.exe -
Executes dropped EXE 1 IoCs
pid Process 2696 0457c6bf851f140d591f32f097b16fb0.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2696 0457c6bf851f140d591f32f097b16fb0.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2696 0457c6bf851f140d591f32f097b16fb0.exe 2696 0457c6bf851f140d591f32f097b16fb0.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1060 0457c6bf851f140d591f32f097b16fb0.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1060 0457c6bf851f140d591f32f097b16fb0.exe 2696 0457c6bf851f140d591f32f097b16fb0.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1060 wrote to memory of 2696 1060 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 1060 wrote to memory of 2696 1060 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 1060 wrote to memory of 2696 1060 0457c6bf851f140d591f32f097b16fb0.exe 18 PID 2696 wrote to memory of 5488 2696 0457c6bf851f140d591f32f097b16fb0.exe 42 PID 2696 wrote to memory of 5488 2696 0457c6bf851f140d591f32f097b16fb0.exe 42 PID 2696 wrote to memory of 5488 2696 0457c6bf851f140d591f32f097b16fb0.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe"C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exeC:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0457c6bf851f140d591f32f097b16fb0.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:5488
-
-