Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
75d06019796327a448641d0605ee0e74.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75d06019796327a448641d0605ee0e74.exe
Resource
win10v2004-20231215-en
General
-
Target
75d06019796327a448641d0605ee0e74.exe
-
Size
1000KB
-
MD5
75d06019796327a448641d0605ee0e74
-
SHA1
a5186fb889c327a6b4d5a19098f5758634984955
-
SHA256
cbc8fae703eb3747070657632114f0b7e1ae64b0f9455b18b37433dcf85241b7
-
SHA512
3e8146a06714286e5fedfa02b5736261a08f3fe34ef19011a17df5f20cb51624ec0d832581491500b7308d9fb2cf1b55e1fc2c215c02154fc5109a27c1a4ef76
-
SSDEEP
24576:WW88yy3TWrZX4K/tYjsRciCW4F5NrZHiJ81B+5vMiqt0gj2ed:WjaWo3j7LDNrZHiJeqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2880 75d06019796327a448641d0605ee0e74.exe -
Executes dropped EXE 1 IoCs
pid Process 2880 75d06019796327a448641d0605ee0e74.exe -
Loads dropped DLL 1 IoCs
pid Process 1656 75d06019796327a448641d0605ee0e74.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2880 75d06019796327a448641d0605ee0e74.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2880 75d06019796327a448641d0605ee0e74.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1656 75d06019796327a448641d0605ee0e74.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1656 75d06019796327a448641d0605ee0e74.exe 2880 75d06019796327a448641d0605ee0e74.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2880 1656 75d06019796327a448641d0605ee0e74.exe 16 PID 1656 wrote to memory of 2880 1656 75d06019796327a448641d0605ee0e74.exe 16 PID 1656 wrote to memory of 2880 1656 75d06019796327a448641d0605ee0e74.exe 16 PID 1656 wrote to memory of 2880 1656 75d06019796327a448641d0605ee0e74.exe 16 PID 2880 wrote to memory of 2908 2880 75d06019796327a448641d0605ee0e74.exe 15 PID 2880 wrote to memory of 2908 2880 75d06019796327a448641d0605ee0e74.exe 15 PID 2880 wrote to memory of 2908 2880 75d06019796327a448641d0605ee0e74.exe 15 PID 2880 wrote to memory of 2908 2880 75d06019796327a448641d0605ee0e74.exe 15
Processes
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\75d06019796327a448641d0605ee0e74.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:2908
-
C:\Users\Admin\AppData\Local\Temp\75d06019796327a448641d0605ee0e74.exeC:\Users\Admin\AppData\Local\Temp\75d06019796327a448641d0605ee0e74.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2880
-
C:\Users\Admin\AppData\Local\Temp\75d06019796327a448641d0605ee0e74.exe"C:\Users\Admin\AppData\Local\Temp\75d06019796327a448641d0605ee0e74.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1656