Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/01/2024, 18:57
General
-
Target
41a83a730b9ced8a7ee2d1144b23a7d7.exe
-
Size
506KB
-
MD5
41a83a730b9ced8a7ee2d1144b23a7d7
-
SHA1
da786d4cfed1585b35b366d85c5b436fcb1d7464
-
SHA256
7da3e295f44b0e9a5c81ca11a0f408d460c7bff56e3bf72f8fdd36af558fa8b4
-
SHA512
33597ad83291d1797f4f7bac72d2e90bcf028bc549082de9f68ab1124bc7a34ce8df7dec3dc7ff86d94b2106f27e40d1c4ddc05401fea2aa23b9029044bc2226
-
SSDEEP
12288:+PgX44XAvmF1UYn23AyZRhn0Q4GYIqARtY/yB4:+Pg1XHFOq23JZfEG5m/64
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41a83a730b9ced8a7ee2d1144b23a7d7.exe"C:\Users\Admin\AppData\Local\Temp\41a83a730b9ced8a7ee2d1144b23a7d7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41a83a730b9ced8a7ee2d1144b23a7d7.exeC:\Users\Admin\AppData\Local\Temp\41a83a730b9ced8a7ee2d1144b23a7d7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\41a83a730b9ced8a7ee2d1144b23a7d7.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD560bb78b6433408c933759b20f96858b8
SHA1cce24c98f89fcb8b77f9c8b226f9170ebba03d8e
SHA256a3aa17f1f4fcd1af38c68213902c08945751c7aaccaef98fc07b0520da4fd431
SHA51203da47428d21fea54086f8b063cfe7739947970cf79daa995bff519e8a78cecaf9f641412012676936e009332d7d7a5ea56f94e101e28e9a1adce0140be93bd0
-
Filesize
506KB
MD50e00433dee217dd5df9d534a662cd705
SHA1ff445d67ef2446df3ff224ebc2a5236c96f03e80
SHA25662dfbb0682c37cafa206bc684a4f73d79ca62dca975fae92223daaa23596bfed
SHA5124d5815ff03824c9933d021e0a4f643c8d2e4925745bf07ff3763415fdc293d5b86f2e581e8dda2f0c3629c3b98c0e07a2300b8cd81e1dcbb1c57cfa7841e0d17
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
474KB
MD5e015179f63c427d187a7bc4a95f227f7
SHA1c3a59997542d02cc8c6dadfcd6bed261e4c6aebc
SHA2568a092ee7f0ce44ce7894ebc85c030093d6d63721ef098393298f75a31950bb31
SHA5129360e15d5478dba7333cbbda0f4d754ef9970dc35a813841476812422c665130192c69e5c690fa98480de8f46c125f6f3d16b6bb02a1c65d55bde65c8ce324d5
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
364KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
364KB