Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 05:12

General

  • Target

    5811412a8cf5b213a4c145ba4f772f12.exe

  • Size

    506KB

  • MD5

    5811412a8cf5b213a4c145ba4f772f12

  • SHA1

    f3744207e2263573bffb42afac47236339b5afaa

  • SHA256

    ae86d7d7151eef17c2bbbdda74ce298362eb874344fdc41a6c542d72f2b0a31b

  • SHA512

    0e833c0c5842e4f86793b1f7aa4d952b20b557c6358fc6f679a9206b59e8dc8971d5813f77477f04dc11c9f60091e90897cb4c32c2cc9aef9e1bb27a6648bda4

  • SSDEEP

    12288:QhroMQHJ+srmfVjkkEBAvpbeEkHNUBBPUJRX07NZtnr:gQMmmtjzvAEsNUBBpNZtnr

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5811412a8cf5b213a4c145ba4f772f12.exe
    "C:\Users\Admin\AppData\Local\Temp\5811412a8cf5b213a4c145ba4f772f12.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\5811412a8cf5b213a4c145ba4f772f12.exe
      C:\Users\Admin\AppData\Local\Temp\5811412a8cf5b213a4c145ba4f772f12.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5811412a8cf5b213a4c145ba4f772f12.exe" /TN Google_Trk_Updater /F
        3⤵
        • Creates scheduled task(s)
        PID:1364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5811412a8cf5b213a4c145ba4f772f12.exe

    Filesize

    506KB

    MD5

    647219b41379912e1798a040fd819b7a

    SHA1

    1cd985410599bfe8dd3d804664e23c0d67312faf

    SHA256

    b7a07b3b4d6eb341ed7913ca81763efbdb4e868f6a8043b881005876a13aad11

    SHA512

    76d7915b70b9b5f291cae29ea413ceb3a2d9e751d0aa32b96bf294e7e51eb41a9fd258e1f8668755057388a06e6669e27274856f2971b7ab861aa47f6f2fa009

  • memory/1720-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1720-1-0x0000000000160000-0x00000000001E3000-memory.dmp

    Filesize

    524KB

  • memory/1720-2-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/1720-11-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/4544-13-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4544-14-0x0000000001510000-0x0000000001593000-memory.dmp

    Filesize

    524KB

  • memory/4544-20-0x0000000004FB0000-0x000000000502E000-memory.dmp

    Filesize

    504KB

  • memory/4544-21-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/4544-27-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB