Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28/12/2023, 23:29
General
-
Target
ffecb4999889f9dff3f3ca807aa462ac.exe
-
Size
1000KB
-
MD5
ffecb4999889f9dff3f3ca807aa462ac
-
SHA1
1405ccffb6a9cdfab47b9e8ef7cea6025304a058
-
SHA256
3b46860e7ffdcc531af1dd81752cce9ae5f410fa1d9b6d1ac3409801c9d8d9c4
-
SHA512
0c0371aa5be01301f8b7c1a9490813ed5f5e16c6f6e489666dcd8acb98eb64968f1ec018f779a2b85f36ba504f7d79e6cf376e115be59da00dfedcb45bc725eb
-
SSDEEP
24576:sNp5IbLWzXcsQPCtKP/VN1B+5vMiqt0gj2ed:sNYPvlPlPNhqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffecb4999889f9dff3f3ca807aa462ac.exe"C:\Users\Admin\AppData\Local\Temp\ffecb4999889f9dff3f3ca807aa462ac.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ffecb4999889f9dff3f3ca807aa462ac.exeC:\Users\Admin\AppData\Local\Temp\ffecb4999889f9dff3f3ca807aa462ac.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\ffecb4999889f9dff3f3ca807aa462ac.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD5247578d70e5008a3d3633a2fcdd5fec1
SHA1ecb7533812b19e15fbd1d29a2557634a841329ce
SHA256cce30dd56caa912cc45b3bfed10e22f8e4331cc80baf4315bd7714b789f343b1
SHA51273e31d20bca99d66ce7f8109b186faeb7f71c04dd6e93adf217a81ae4b4c639d3f58563e9abedbc041476a09259ee47cfd4c8ba9f58fdcdef0a122127863b2a8
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
504KB