Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
18a77ac253bd6a684f5d6d8f546f274d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
18a77ac253bd6a684f5d6d8f546f274d.exe
Resource
win10v2004-20231215-en
General
-
Target
18a77ac253bd6a684f5d6d8f546f274d.exe
-
Size
241KB
-
MD5
18a77ac253bd6a684f5d6d8f546f274d
-
SHA1
664079f287f1ef9dcf6955f8df7c5a4ebca19129
-
SHA256
baa3b869d2a37cfa7049c48ebe7eaafbcb723ecf9f831fafa1559f41dd21ffbf
-
SHA512
8a974fe79a0d648c2deda26b9d559dd43054969d35db52a6f36e7a007af568b3eac0093890ac3b4fe2932470e4e417bf87f9ae593908c2c0b3406d54ff78c41c
-
SSDEEP
6144:AmDVEIwn3qkNM7Y65dT/7Nxu07ywuwX4kaYkzs45+:AmDVEIca4M35dT/7NRewuwWsA+
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2772 18a77ac253bd6a684f5d6d8f546f274d.exe -
Executes dropped EXE 1 IoCs
pid Process 2772 18a77ac253bd6a684f5d6d8f546f274d.exe -
Loads dropped DLL 1 IoCs
pid Process 2352 18a77ac253bd6a684f5d6d8f546f274d.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2772 18a77ac253bd6a684f5d6d8f546f274d.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2772 18a77ac253bd6a684f5d6d8f546f274d.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2352 18a77ac253bd6a684f5d6d8f546f274d.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2352 18a77ac253bd6a684f5d6d8f546f274d.exe 2772 18a77ac253bd6a684f5d6d8f546f274d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2772 2352 18a77ac253bd6a684f5d6d8f546f274d.exe 16 PID 2352 wrote to memory of 2772 2352 18a77ac253bd6a684f5d6d8f546f274d.exe 16 PID 2352 wrote to memory of 2772 2352 18a77ac253bd6a684f5d6d8f546f274d.exe 16 PID 2352 wrote to memory of 2772 2352 18a77ac253bd6a684f5d6d8f546f274d.exe 16 PID 2772 wrote to memory of 2544 2772 18a77ac253bd6a684f5d6d8f546f274d.exe 17 PID 2772 wrote to memory of 2544 2772 18a77ac253bd6a684f5d6d8f546f274d.exe 17 PID 2772 wrote to memory of 2544 2772 18a77ac253bd6a684f5d6d8f546f274d.exe 17 PID 2772 wrote to memory of 2544 2772 18a77ac253bd6a684f5d6d8f546f274d.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe"C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exeC:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\18a77ac253bd6a684f5d6d8f546f274d.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD58b3fe2306677751f846bfc5482946360
SHA134e78c601aba24731bec814998e6bcb2145d9427
SHA2565836f51b08415fd65ea0f7279fd3afdd1b25db73c0d88970b17a3e8ac06d4c2b
SHA5128310f4c37d3cba6b990979751ee032f323f3581fdd3e719652d46e1e7d3d87ec9f12e98506fc84888c07109eaafb073de162a5b7a49d14359c29b1f4dfcdae90
-
Filesize
54KB
MD555a6e4a1e5e2e1bd615730d9e29f7166
SHA11a5e1bd1ca9b2a86ccbdafb50be5b8b51e96c4e8
SHA2566c9df7e44f8554c3bafb7bf57067168141ef9d4ca24042a758489ff9914aa9ac
SHA512f095a05906f7e949bea0064b0e4fd01e21244dd097470185b2ccace484951e9a7a248f6ef5b1297bbe5e94751c88a0e866a0064510b5d5e8964cb5aab908461b