Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
678923982bc7d83f53fdf068b43b77e4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
678923982bc7d83f53fdf068b43b77e4.exe
Resource
win10v2004-20231215-en
General
-
Target
678923982bc7d83f53fdf068b43b77e4.exe
-
Size
241KB
-
MD5
678923982bc7d83f53fdf068b43b77e4
-
SHA1
ed9e274db40ec0b883e9e81f83c29a51d2efd5bb
-
SHA256
b0359d70616a189371e54a169398521c0114c73e797ef0ae849becae1014cbb7
-
SHA512
b0ec90342c3aab0ec1071ad99442c02fc5442ed3a7d2b2637fe8b439a325d18e42d778205f795f1ff926203e333efd1bcb4cabeefe18109fe8e62a5c48980cda
-
SSDEEP
6144:tmU5DJi8BnA/dizLz5O7YLm4nrhk9CrwuMXjXYDEU:tm8NV+/gQ+xFk9Cr6TYr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4064 678923982bc7d83f53fdf068b43b77e4.exe -
Executes dropped EXE 1 IoCs
pid Process 4064 678923982bc7d83f53fdf068b43b77e4.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4064 678923982bc7d83f53fdf068b43b77e4.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2660 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4064 678923982bc7d83f53fdf068b43b77e4.exe 4064 678923982bc7d83f53fdf068b43b77e4.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2672 678923982bc7d83f53fdf068b43b77e4.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2672 678923982bc7d83f53fdf068b43b77e4.exe 4064 678923982bc7d83f53fdf068b43b77e4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4064 2672 678923982bc7d83f53fdf068b43b77e4.exe 15 PID 2672 wrote to memory of 4064 2672 678923982bc7d83f53fdf068b43b77e4.exe 15 PID 2672 wrote to memory of 4064 2672 678923982bc7d83f53fdf068b43b77e4.exe 15 PID 4064 wrote to memory of 2660 4064 678923982bc7d83f53fdf068b43b77e4.exe 36 PID 4064 wrote to memory of 2660 4064 678923982bc7d83f53fdf068b43b77e4.exe 36 PID 4064 wrote to memory of 2660 4064 678923982bc7d83f53fdf068b43b77e4.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\678923982bc7d83f53fdf068b43b77e4.exe"C:\Users\Admin\AppData\Local\Temp\678923982bc7d83f53fdf068b43b77e4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\678923982bc7d83f53fdf068b43b77e4.exeC:\Users\Admin\AppData\Local\Temp\678923982bc7d83f53fdf068b43b77e4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\678923982bc7d83f53fdf068b43b77e4.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2660
-
-