Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    170s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 18:32

General

  • Target

    34c70052f3c856d6dcf84398775d1ea1.exe

  • Size

    506KB

  • MD5

    34c70052f3c856d6dcf84398775d1ea1

  • SHA1

    512246cfb490e31d955f10feb7e3c354d5cfdd26

  • SHA256

    b92cbde7da803faaf6c1f47c8df4f7b55e26683751009ea099270367562eba56

  • SHA512

    ec5db2c8067ca5d5937494e6c975ef167e37d224bb8e4ad0a827b1fce91d3897fc5decd8e4952c19475f73cc750b0f94bb9735dbe8c9718116aa89ac844d05a3

  • SSDEEP

    12288:wpPRpX9VgKYCMev+NIfxeCZV1Xym+uvoHXK3iKC8QzO0N:oX3g/CMcuwlZV1izJ0iHa0N

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe
    "C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe
      C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe" /TN Google_Trk_Updater /F
        3⤵
        • Creates scheduled task(s)
        PID:3360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\34c70052f3c856d6dcf84398775d1ea1.exe

    Filesize

    460KB

    MD5

    d87d3ffc41a5a03ac1e8ffad13871db9

    SHA1

    c812d7d906ff307aff224f12df2cde22d896044b

    SHA256

    f595b481e7e494b691b5efcb30b0256ae158ddd62c3acb0f8962c8f148e70146

    SHA512

    ddce919e0f3447dc9b3df5525f21e01ea05ca72318b71a02fe69d5ecc6d7062f991b99f087c123a1050a1a26ac5ced566fce97004d7e4841fa5a2cdc3655380a

  • memory/4220-13-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4220-16-0x0000000000160000-0x00000000001E3000-memory.dmp

    Filesize

    524KB

  • memory/4220-21-0x0000000004F30000-0x0000000004FAE000-memory.dmp

    Filesize

    504KB

  • memory/4220-20-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/4220-27-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/4676-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4676-1-0x00000000015E0000-0x0000000001663000-memory.dmp

    Filesize

    524KB

  • memory/4676-2-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/4676-11-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB