Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
43bdbbf12d876c39f8866a6a8f8400e1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
43bdbbf12d876c39f8866a6a8f8400e1.exe
Resource
win10v2004-20231222-en
General
-
Target
43bdbbf12d876c39f8866a6a8f8400e1.exe
-
Size
1.2MB
-
MD5
43bdbbf12d876c39f8866a6a8f8400e1
-
SHA1
8073e93095aa648866c32d53b3572b52497c0bcd
-
SHA256
e954cc80416a0beecfa125197fd28446ba6f1f01d748eafb0cf334762dbc8dee
-
SHA512
cfd3552d54e8d6ce9f4fc8702bae6eebfb2797d8bcec18db0f81d2833458a4c0134d00a6c4b7506b179b0f3ae5ad16e92ad611020160eff81906bb9f8e87cd95
-
SSDEEP
24576:piHsZP3U9f4uoIFst0GWKNXJLMTpZuTuRi10jbXGskwFShESPMM6fH:zPkJoPt0GXJLepauRG03bFS5PMM6v
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\International\Geo\Nation 43bdbbf12d876c39f8866a6a8f8400e1.exe Key value queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\International\Geo\Nation GoogleUpdaterSetup.exe -
Executes dropped EXE 1 IoCs
pid Process 2220 GoogleUpdaterSetup.exe -
Loads dropped DLL 4 IoCs
pid Process 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 2220 GoogleUpdaterSetup.exe 2220 GoogleUpdaterSetup.exe 2220 GoogleUpdaterSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2220 GoogleUpdaterSetup.exe 2220 GoogleUpdaterSetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18 PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18 PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18 PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18 PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18 PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18 PID 1948 wrote to memory of 2220 1948 43bdbbf12d876c39f8866a6a8f8400e1.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\43bdbbf12d876c39f8866a6a8f8400e1.exe"C:\Users\Admin\AppData\Local\Temp\43bdbbf12d876c39f8866a6a8f8400e1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\gisf761890\2.4.1739.5352\GoogleUpdaterSetup.exe"C:\Users\Admin\AppData\Local\Temp\gisf761890\2.4.1739.5352\GoogleUpdaterSetup.exe" -install -extra flow=RegularPack&stat=on&r=ci_gapps.en,ci_picasa.en&brand=GPCK2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\gisf761890\SearchWithGoogleUpdate.exe"C:\Users\Admin\AppData\Local\Temp\gisf761890\2.4.1739.5352\..\SearchWithGoogleUpdate.exe" ci GPCK3⤵PID:2072
-
-
C:\Program Files (x86)\Google\Google Updater\2.4.1739.5352\GoogleUpdaterAdminPrefs.exe"C:\Program Files (x86)\Google\Google Updater\2.4.1739.5352\GoogleUpdaterAdminPrefs.exe" /RegServer3⤵PID:576
-
-
C:\Program Files (x86)\Google\Google Updater\2.4.1739.5352\GoogleUpdaterInstallMgr.exe"C:\Program Files (x86)\Google\Google Updater\2.4.1739.5352\GoogleUpdaterInstallMgr.exe" /RegServer3⤵PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\gisf761890\GoogleUpdaterService.exe"C:\Users\Admin\AppData\Local\Temp\gisf761890\GoogleUpdaterService.exe" /install /appid=GoogleUpdater /auto3⤵PID:2932
-
-
-
C:\Users\Admin\AppData\Local\Temp\gisf761890\GoogleUpdater.exe"C:\Users\Admin\AppData\Local\Temp\gisf761890\GoogleUpdater.exe" -trampoline -t "C:\Users\Admin\AppData\Local\Temp\gisf761890" -extra flow=RegularPack&stat=on&r=ci_gapps.en,ci_picasa.en&brand=GPCK2⤵PID:2184
-
C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe"C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe" -t C:\Users\Admin\AppData\Local\Temp\gisf761890 -extra flow=RegularPack&stat=on&r=ci_gapps.en,ci_picasa.en&brand=GPCK3⤵PID:2144
-
-
-
C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe"C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe" -restart_ieuser1⤵PID:1788
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe -s "C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll"1⤵PID:1056
-
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" -Embedding1⤵PID:1936
-
C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe"C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe" -systray1⤵PID:2808
-
C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe"C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe" -checkup1⤵PID:2772
-
C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe"C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe" -checkup -httputilsonly2⤵PID:1940
-
-
C:\Program Files (x86)\Google\Google Updater\2.4.1739.5352\GoogleUpdaterInstallMgr.exe"C:\Program Files (x86)\Google\Google Updater\2.4.1739.5352\GoogleUpdaterInstallMgr.exe" -Embedding1⤵PID:1312
-
C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe" /install /appid=swg1⤵PID:2300
-
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" /RegServer "/dll=C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\gtn.dll"1⤵PID:1548
-
C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"1⤵PID:1592
-
C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe" /Service1⤵PID:2964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
174KB
MD54ec3b0aa9591469684d0b86822819397
SHA1cbb0aa8886764192fe28f6d6c0b564111ad5e43f
SHA256726e8033b90212798c17f439cff2cd939e4878255e3261a951d42d2b6b8a3f3b
SHA512d30e1bb701aa46c686a052532e12a0e768fa911f7993ca53caa1308818124fe24ae53096d7da3e7901a84c4015d8727cdfe353aa46c1389d7d5c3ae6ba604097
-
Filesize
94KB
MD5b8ede45340c0ee9003fe16b9e6e3f7cc
SHA1989a81fc8760b6e330eb53492993971a17441ec4
SHA256cd40238a77738d5bbb2c25c7bab47c369bf59d0f67e60a95709008cd495f954c
SHA512027be8d5e4792e5b820e2726d66958f7e5d36f3427559fa4608a633cf2f92ae91f488d3f372cba43bbe1fc0c42ecb06759e2db5b5c817d033095e7c311bf6d53
-
Filesize
51KB
MD590fbd8ba323d7faafc5857bf773f31b8
SHA1c399f8ad8b21a9ab2dbf8f532cc555345448051f
SHA256e1bf851d4cab84683aaf945c312d3ba0ad5ca3111ef0a4f63e91d6d34d0b339b
SHA5125fef6c9886fe7df86d56180bc18287038bad3f8703a531d286abd39c7b13ac81574e394fef1e72446a3ce06463ef641a0c1bb93df38fa510630349558627f729
-
Filesize
92KB
MD5696eb90293f96c86e7e727f1de4cd29a
SHA154030fe057940630438943b11963b2313291341e
SHA256d954e1b750f5cdeab55f4f9fa7eaa38b037433b91bfaf2531075a5702f71b5c2
SHA512755dcb430be4ee9dc3bade9e787297ca65857451c4b2b72c428046460e2dc608b5a3743499183c670fdf364a15a5eade4c32dd8b0f5c8a1aa39ddddf0065d60a
-
Filesize
98KB
MD5a8ddf82cef6d22dae692bf24f3f0a55a
SHA15825c4d5d0d65e9b9aa60a6a529c29be92ca56c4
SHA2568abd2e58a2898ba5443438687d43f8822a1c0620566ed58dcdb1af746f0a7304
SHA5125aadb0479df9cffab9ae4dbf83dc20c0338518578f2df3ed220de420ee484a2e9b61d5f497b7c60d38ff53807521e849dc5f2b0bd8da7ed9df31b3c1fb7cecb6