Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 06:59
General
-
Target
0d378cae60f385be83748e9d64d823d9.exe
-
Size
506KB
-
MD5
0d378cae60f385be83748e9d64d823d9
-
SHA1
2908b6cd0ea103d677bdd28f20d39b6fd9b1d899
-
SHA256
95e37b1407516365c0a7345abd128443d27bc4810866ee985cd2ca2695ce91f2
-
SHA512
4b59a98be3508dcbbf5ecec79c5386085a6fb1092ee762ae5988e490e3e7719ca09f16ebe1bb3e3ae58688458dddb27a5c6d0546d73c54855bdf0cb0fd518661
-
SSDEEP
12288:XCeezHRa9nSEpf+6op4lPrteJUOZenhaJbKTyduhAeRJobkHYY9h2WAWsT:VWHI9nhGz2PpeJUOwhEbcyduhAeRJ2ko
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d378cae60f385be83748e9d64d823d9.exe"C:\Users\Admin\AppData\Local\Temp\0d378cae60f385be83748e9d64d823d9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0d378cae60f385be83748e9d64d823d9.exeC:\Users\Admin\AppData\Local\Temp\0d378cae60f385be83748e9d64d823d9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0d378cae60f385be83748e9d64d823d9.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD567568a980838e1d9e848ac41a4ba8dc5
SHA1085b0ad7e40db019c1f1790061e8430517d17993
SHA256b43251a5a2b48f3bfbde12055cf9ee04f2781eab85664a45cf1c766fcc5cd43e
SHA512503736acd874b5562ee91b034e4647cf49831162bc8d2e7a159d1801f760def2c16169b685c7c8f4ab299ca3ddf34078b43ce4ba357b7d5039fe90c96001bfc8
-
Filesize
92KB
MD5a60d1684528eb91fcfedb99a173b6f9c
SHA12062547a03c342d1cfaa56396aa190f78912be50
SHA2565af8bebed36f8e5a2587ec4d3fb7cc6022f2fc814af9dce4f50f5c6e3641656d
SHA51209a2871b05921824899aaa4a849f34ea01609bfdfaa7a8bfb8c7d1298f09eab51eedb0932d1a832d7260dedd424b92932f8429ab8923d1bca72c1d1abcc8ec6b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
391KB
MD56a9ba63ff88227976067924a6d546f59
SHA12ece45878049801f8161806cb96309720ba1e4f5
SHA2560345e1bc12613746c88dd84c466a986469d2f7a7097aaf3724f1743a6e1bb2dc
SHA512f5d150ce6df9daa07472e3b1c2af3dd6d78d963e9740181d8fb5972fa88301e407018f8f059171b5c9c3aa5fe8e51e741a473712127f7d152dbd06c6d6073b57
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB