Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
34c70052f3c856d6dcf84398775d1ea1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
34c70052f3c856d6dcf84398775d1ea1.exe
Resource
win10v2004-20231215-en
General
-
Target
34c70052f3c856d6dcf84398775d1ea1.exe
-
Size
506KB
-
MD5
34c70052f3c856d6dcf84398775d1ea1
-
SHA1
512246cfb490e31d955f10feb7e3c354d5cfdd26
-
SHA256
b92cbde7da803faaf6c1f47c8df4f7b55e26683751009ea099270367562eba56
-
SHA512
ec5db2c8067ca5d5937494e6c975ef167e37d224bb8e4ad0a827b1fce91d3897fc5decd8e4952c19475f73cc750b0f94bb9735dbe8c9718116aa89ac844d05a3
-
SSDEEP
12288:wpPRpX9VgKYCMev+NIfxeCZV1Xym+uvoHXK3iKC8QzO0N:oX3g/CMcuwlZV1izJ0iHa0N
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4220 34c70052f3c856d6dcf84398775d1ea1.exe -
Executes dropped EXE 1 IoCs
pid Process 4220 34c70052f3c856d6dcf84398775d1ea1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4220 34c70052f3c856d6dcf84398775d1ea1.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3360 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4220 34c70052f3c856d6dcf84398775d1ea1.exe 4220 34c70052f3c856d6dcf84398775d1ea1.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4676 34c70052f3c856d6dcf84398775d1ea1.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4676 34c70052f3c856d6dcf84398775d1ea1.exe 4220 34c70052f3c856d6dcf84398775d1ea1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4676 wrote to memory of 4220 4676 34c70052f3c856d6dcf84398775d1ea1.exe 91 PID 4676 wrote to memory of 4220 4676 34c70052f3c856d6dcf84398775d1ea1.exe 91 PID 4676 wrote to memory of 4220 4676 34c70052f3c856d6dcf84398775d1ea1.exe 91 PID 4220 wrote to memory of 3360 4220 34c70052f3c856d6dcf84398775d1ea1.exe 92 PID 4220 wrote to memory of 3360 4220 34c70052f3c856d6dcf84398775d1ea1.exe 92 PID 4220 wrote to memory of 3360 4220 34c70052f3c856d6dcf84398775d1ea1.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe"C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exeC:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:3360
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD5d87d3ffc41a5a03ac1e8ffad13871db9
SHA1c812d7d906ff307aff224f12df2cde22d896044b
SHA256f595b481e7e494b691b5efcb30b0256ae158ddd62c3acb0f8962c8f148e70146
SHA512ddce919e0f3447dc9b3df5525f21e01ea05ca72318b71a02fe69d5ecc6d7062f991b99f087c123a1050a1a26ac5ced566fce97004d7e4841fa5a2cdc3655380a