Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 05:09
Static task
static1
Behavioral task
behavioral1
Sample
0fa40f175a17ee369070cf6638d7796a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0fa40f175a17ee369070cf6638d7796a.exe
Resource
win10v2004-20231215-en
General
-
Target
0fa40f175a17ee369070cf6638d7796a.exe
-
Size
1000KB
-
MD5
0fa40f175a17ee369070cf6638d7796a
-
SHA1
ece3736af541cf2e1ed5900d359208d67befff39
-
SHA256
228eadff9b864a921cce298d3bc8fa4442a8d5e960dc44c0a78628201e8ff458
-
SHA512
feddac78791ab71eceed4d8362430fec1d42111ee122cf4d2fb5075d2f942a7eca20fb2533a383cb706648cdfb8a34d08a6a5dc71c55d8f29cefbe596525e1f3
-
SSDEEP
24576:h81t83HTQLly48l3mPCb41B+5vMiqt0gj2ed:hEkHTQLljHPCbSqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3000 0fa40f175a17ee369070cf6638d7796a.exe -
Executes dropped EXE 1 IoCs
pid Process 3000 0fa40f175a17ee369070cf6638d7796a.exe -
Loads dropped DLL 1 IoCs
pid Process 2908 0fa40f175a17ee369070cf6638d7796a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3000 0fa40f175a17ee369070cf6638d7796a.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2244 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3000 0fa40f175a17ee369070cf6638d7796a.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2908 0fa40f175a17ee369070cf6638d7796a.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2908 0fa40f175a17ee369070cf6638d7796a.exe 3000 0fa40f175a17ee369070cf6638d7796a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3000 2908 0fa40f175a17ee369070cf6638d7796a.exe 28 PID 2908 wrote to memory of 3000 2908 0fa40f175a17ee369070cf6638d7796a.exe 28 PID 2908 wrote to memory of 3000 2908 0fa40f175a17ee369070cf6638d7796a.exe 28 PID 2908 wrote to memory of 3000 2908 0fa40f175a17ee369070cf6638d7796a.exe 28 PID 3000 wrote to memory of 2244 3000 0fa40f175a17ee369070cf6638d7796a.exe 29 PID 3000 wrote to memory of 2244 3000 0fa40f175a17ee369070cf6638d7796a.exe 29 PID 3000 wrote to memory of 2244 3000 0fa40f175a17ee369070cf6638d7796a.exe 29 PID 3000 wrote to memory of 2244 3000 0fa40f175a17ee369070cf6638d7796a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fa40f175a17ee369070cf6638d7796a.exe"C:\Users\Admin\AppData\Local\Temp\0fa40f175a17ee369070cf6638d7796a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\0fa40f175a17ee369070cf6638d7796a.exeC:\Users\Admin\AppData\Local\Temp\0fa40f175a17ee369070cf6638d7796a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0fa40f175a17ee369070cf6638d7796a.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2244
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
753KB
MD5782f9d18adbe4c90b1d00708a2ce6dd6
SHA14441f1a0c5e22bbfc3e6288967c5aadc33c4c4b3
SHA256b834c5e64100fc5aeca6f5d348e6e929d956d18405bb3c86f696c31c8c07cabb
SHA512e6f73af30fca5d5937e8c8da7e2e4bad2f72808712bb9eef536bb8a89eaf99953b0d075a828fa685c15184135b8eec661af1ba769cf9157c7f781b1d1d978f4e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
1000KB
MD5b985a3fbee8d094236cce0cceac6b1c2
SHA10131b7c08a19cfa9618e44030ef910c0cc5abc14
SHA2566a6020b12fc3748fe423be23f2fdcf4765f92033c28f17cc8f28458be1f90399
SHA5123c316d589a1cec80cb991ccfacd4925b952c05578ee8dad941586555d43fbd043fe11803aed339d6ae1fa6a83e5b9021773b2cb4a485dd523f91bf664d275557