Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
5734ffbafde3b8c0490a1ef0539a9c73.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5734ffbafde3b8c0490a1ef0539a9c73.exe
Resource
win10v2004-20231215-en
General
-
Target
5734ffbafde3b8c0490a1ef0539a9c73.exe
-
Size
506KB
-
MD5
5734ffbafde3b8c0490a1ef0539a9c73
-
SHA1
ee45c77fb35baa09d24b5b03a4c1703643f8af3c
-
SHA256
fae9ba267b2913d32e0a65e4d36faa086f5ec19ef87dfd77d7c4ecc756a2c812
-
SHA512
767c3d1bc787ac78d99ddf23cf67fb46be08610a545e95dd0b17454d00629c4891fea248c82babf4f439794272a51d418ae128d12091cca8dc9b74c5630e8069
-
SSDEEP
6144:kOLpbRqL6BMUiEOCuS0SV1jF98ovfOrKkbmzHhNpI1ThRTpcyeqmNLHvJJAqETyW:kEN33AJ4jFZlHU9AbjhEOW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe -
Executes dropped EXE 1 IoCs
pid Process 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1352 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1312 5734ffbafde3b8c0490a1ef0539a9c73.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1312 5734ffbafde3b8c0490a1ef0539a9c73.exe 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1668 1312 5734ffbafde3b8c0490a1ef0539a9c73.exe 88 PID 1312 wrote to memory of 1668 1312 5734ffbafde3b8c0490a1ef0539a9c73.exe 88 PID 1312 wrote to memory of 1668 1312 5734ffbafde3b8c0490a1ef0539a9c73.exe 88 PID 1668 wrote to memory of 1352 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe 92 PID 1668 wrote to memory of 1352 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe 92 PID 1668 wrote to memory of 1352 1668 5734ffbafde3b8c0490a1ef0539a9c73.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe"C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exeC:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5734ffbafde3b8c0490a1ef0539a9c73.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:1352
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD544a33e1b9557f0a7b68a6c6cd98d806b
SHA1f61a38337284a01575193b7fb9f75872dfae3a56
SHA2560002f13aaea16e0033fe9ed0483276f442c975f9de6c73ca88115ced89e3509d
SHA51218f8dca170aef47072cdad834a239a25fba365856953ba5a5ac685e9196b1b8ef5b9115264d2b17b776b3b12915695e5f0049ac19bb7f72f4e09efdd50f607bc