Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
413c800774c2169d9764c4b71fe0b6a6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
413c800774c2169d9764c4b71fe0b6a6.exe
Resource
win10v2004-20231222-en
General
-
Target
413c800774c2169d9764c4b71fe0b6a6.exe
-
Size
506KB
-
MD5
413c800774c2169d9764c4b71fe0b6a6
-
SHA1
27c17fdd878f512e3953ecb1258083866dcd2bc4
-
SHA256
1606a4e0484b9da96b2eb49c639afc88f461144a8e62777b0ff05f4f41c265c9
-
SHA512
b30773f1a6b9dfb53c9324eca7719746d7d1b30303c8a0678640b1460df60cbefcaf84bde3ee7a393fbb00b974f6ba81c5e5cbcbce3bbe3f7e403f636d5b1120
-
SSDEEP
12288:aEotgFF8tuho2cHQn/AY5SSTjhqt/ZyWn:4tcF8t6cH0I2lTwjn
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1528 413c800774c2169d9764c4b71fe0b6a6.exe -
Executes dropped EXE 1 IoCs
pid Process 1528 413c800774c2169d9764c4b71fe0b6a6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1528 413c800774c2169d9764c4b71fe0b6a6.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4556 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1528 413c800774c2169d9764c4b71fe0b6a6.exe 1528 413c800774c2169d9764c4b71fe0b6a6.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4872 413c800774c2169d9764c4b71fe0b6a6.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4872 413c800774c2169d9764c4b71fe0b6a6.exe 1528 413c800774c2169d9764c4b71fe0b6a6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4872 wrote to memory of 1528 4872 413c800774c2169d9764c4b71fe0b6a6.exe 21 PID 4872 wrote to memory of 1528 4872 413c800774c2169d9764c4b71fe0b6a6.exe 21 PID 4872 wrote to memory of 1528 4872 413c800774c2169d9764c4b71fe0b6a6.exe 21 PID 1528 wrote to memory of 4556 1528 413c800774c2169d9764c4b71fe0b6a6.exe 19 PID 1528 wrote to memory of 4556 1528 413c800774c2169d9764c4b71fe0b6a6.exe 19 PID 1528 wrote to memory of 4556 1528 413c800774c2169d9764c4b71fe0b6a6.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\413c800774c2169d9764c4b71fe0b6a6.exe"C:\Users\Admin\AppData\Local\Temp\413c800774c2169d9764c4b71fe0b6a6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\413c800774c2169d9764c4b71fe0b6a6.exeC:\Users\Admin\AppData\Local\Temp\413c800774c2169d9764c4b71fe0b6a6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\413c800774c2169d9764c4b71fe0b6a6.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:4556