Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
506d442f550ae7277c111faa9d7bde6f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
506d442f550ae7277c111faa9d7bde6f.exe
Resource
win10v2004-20231215-en
General
-
Target
506d442f550ae7277c111faa9d7bde6f.exe
-
Size
506KB
-
MD5
506d442f550ae7277c111faa9d7bde6f
-
SHA1
d2188d5ecd021a2eedc19001ac06e510638b4100
-
SHA256
a832c6c96a31075ab3f04e37f40e542d75c5f7b88e80574e283845bd35a01d11
-
SHA512
b545b4d33266db0f30ce9e6d0eb10a4076800e2cea77752c513ab20673cff63b99b5c4b9388795ae3b9755eea99aa6ef17dd5e1419980c728bcacc785cc12b17
-
SSDEEP
12288:KFDI9l8n7+kgyp4vaDD+TPMbJM5UzRXzui3UDuZjNG2wzLDiOcy:xs7+k/KaDWUxz9v3PNx8l
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1556 506d442f550ae7277c111faa9d7bde6f.exe -
Executes dropped EXE 1 IoCs
pid Process 1556 506d442f550ae7277c111faa9d7bde6f.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1556 506d442f550ae7277c111faa9d7bde6f.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1556 506d442f550ae7277c111faa9d7bde6f.exe 1556 506d442f550ae7277c111faa9d7bde6f.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1208 506d442f550ae7277c111faa9d7bde6f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1208 506d442f550ae7277c111faa9d7bde6f.exe 1556 506d442f550ae7277c111faa9d7bde6f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1556 1208 506d442f550ae7277c111faa9d7bde6f.exe 89 PID 1208 wrote to memory of 1556 1208 506d442f550ae7277c111faa9d7bde6f.exe 89 PID 1208 wrote to memory of 1556 1208 506d442f550ae7277c111faa9d7bde6f.exe 89 PID 1556 wrote to memory of 3260 1556 506d442f550ae7277c111faa9d7bde6f.exe 92 PID 1556 wrote to memory of 3260 1556 506d442f550ae7277c111faa9d7bde6f.exe 92 PID 1556 wrote to memory of 3260 1556 506d442f550ae7277c111faa9d7bde6f.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\506d442f550ae7277c111faa9d7bde6f.exe"C:\Users\Admin\AppData\Local\Temp\506d442f550ae7277c111faa9d7bde6f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\506d442f550ae7277c111faa9d7bde6f.exeC:\Users\Admin\AppData\Local\Temp\506d442f550ae7277c111faa9d7bde6f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\506d442f550ae7277c111faa9d7bde6f.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:3260
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5d3d7b6032b579eb4ce3fad001b963136
SHA11978363e54c6dfb1c5ee2b56dfab4013ca42ce19
SHA256366b9c02c0db89731b80ea6e59ac6727bacb6698095d892b38751ae0c2e4d3ab
SHA5129351d1e71da0add0b8eb2d0ef34dbe1daf1ec482d7c020f791094866a672c566f3988bf750b94be442f5a1cf8abb27a226a818d6d616473c035f9af475ad49fe