Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
019440702c11342aed21f6539653716b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
019440702c11342aed21f6539653716b.exe
Resource
win10v2004-20231215-en
General
-
Target
019440702c11342aed21f6539653716b.exe
-
Size
506KB
-
MD5
019440702c11342aed21f6539653716b
-
SHA1
2f19461bcf6e94204840cc931ca049c18fa872b9
-
SHA256
a102c8b3b68e63a1687366838b602bdaafb204d7a30aee84272425ee522af2f6
-
SHA512
da922276a953ceeaf2c83faea9b60ee10726d7cb02ed1b812df1bdbb3d05b528a2eadf2364f7852d221c33f8df73f184d56464943e33c815a6395dd68eea780c
-
SSDEEP
12288:YYmefq1/HWfYrp/KXyFYI+jmtBgpkNESShYEcaoJUgZy:5mef2HD47IcAL0YR9Zy
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1384 019440702c11342aed21f6539653716b.exe -
Executes dropped EXE 1 IoCs
pid Process 1384 019440702c11342aed21f6539653716b.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1384 019440702c11342aed21f6539653716b.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3372 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1384 019440702c11342aed21f6539653716b.exe 1384 019440702c11342aed21f6539653716b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1452 019440702c11342aed21f6539653716b.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1452 019440702c11342aed21f6539653716b.exe 1384 019440702c11342aed21f6539653716b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1384 1452 019440702c11342aed21f6539653716b.exe 21 PID 1452 wrote to memory of 1384 1452 019440702c11342aed21f6539653716b.exe 21 PID 1452 wrote to memory of 1384 1452 019440702c11342aed21f6539653716b.exe 21 PID 1384 wrote to memory of 3372 1384 019440702c11342aed21f6539653716b.exe 18 PID 1384 wrote to memory of 3372 1384 019440702c11342aed21f6539653716b.exe 18 PID 1384 wrote to memory of 3372 1384 019440702c11342aed21f6539653716b.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\019440702c11342aed21f6539653716b.exe"C:\Users\Admin\AppData\Local\Temp\019440702c11342aed21f6539653716b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\019440702c11342aed21f6539653716b.exeC:\Users\Admin\AppData\Local\Temp\019440702c11342aed21f6539653716b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\019440702c11342aed21f6539653716b.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:3372