Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
25ba4f0d2634fd6d465855d7ef91ff93.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25ba4f0d2634fd6d465855d7ef91ff93.exe
Resource
win10v2004-20231215-en
General
-
Target
25ba4f0d2634fd6d465855d7ef91ff93.exe
-
Size
506KB
-
MD5
25ba4f0d2634fd6d465855d7ef91ff93
-
SHA1
4b3796a76b9048fd0545f74301ddc6e4be2238c9
-
SHA256
5935a83bfa3d24efd0b9be6eb6fe7121d150ba9ff1657e882afd8e40bf330e94
-
SHA512
351439e410177f8d7bfc2fb97ec6f4fa88e8cfe4548c1cbf98ef7e8c2b26d9dd1a597fdfeeb906e7a9914c4376ec82d5a8f86ee9bd45d46e1cb62638bbeaf460
-
SSDEEP
6144:UJMptJBFcOc92VbT7uGJQf4ciAdU7q/35XmbxGlB1RG6tKXiHC9tD/pLTsqcOa0c:lDKUbPlSgh7qRXIxGljcDSHaR3FOvP
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe -
Executes dropped EXE 1 IoCs
pid Process 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2844 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2044 25ba4f0d2634fd6d465855d7ef91ff93.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2044 25ba4f0d2634fd6d465855d7ef91ff93.exe 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1532 2044 25ba4f0d2634fd6d465855d7ef91ff93.exe 92 PID 2044 wrote to memory of 1532 2044 25ba4f0d2634fd6d465855d7ef91ff93.exe 92 PID 2044 wrote to memory of 1532 2044 25ba4f0d2634fd6d465855d7ef91ff93.exe 92 PID 1532 wrote to memory of 2844 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe 93 PID 1532 wrote to memory of 2844 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe 93 PID 1532 wrote to memory of 2844 1532 25ba4f0d2634fd6d465855d7ef91ff93.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\25ba4f0d2634fd6d465855d7ef91ff93.exe"C:\Users\Admin\AppData\Local\Temp\25ba4f0d2634fd6d465855d7ef91ff93.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\25ba4f0d2634fd6d465855d7ef91ff93.exeC:\Users\Admin\AppData\Local\Temp\25ba4f0d2634fd6d465855d7ef91ff93.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\25ba4f0d2634fd6d465855d7ef91ff93.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2844
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD51c133369090fccc8971a1a0da9e7939b
SHA160676b9f9e4a5e8127cdb3fced6b353d2eaa9c6e
SHA256add53c65ac8fc7e5e655734003d9efe3cfbd8fca5f3972dd2dfeee5db75f07b9
SHA51205ace5aa0d71cfc2f6eeec4a1b564a47ac9fa721b77bd21bea4d86a4734713e48b8d857cd444d5922f0bbd12a528ca13d3d9fbbae239107c64a87317c07d8a61