Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
5a63406b23ff0dc56eea143b13854c7e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a63406b23ff0dc56eea143b13854c7e.exe
Resource
win10v2004-20231222-en
General
-
Target
5a63406b23ff0dc56eea143b13854c7e.exe
-
Size
506KB
-
MD5
5a63406b23ff0dc56eea143b13854c7e
-
SHA1
3b7ad1f6247663390c782aeae7f863262780a27f
-
SHA256
396514c15cc576af9c3a5bdd5d69e5425d051d5ecd53b32597089f2695083e0f
-
SHA512
765f86d217620b331419a2620f447721d26a19c157915ffd721b67a4ee47aa7e33a232d0732351dadada2501cd50b6cf36570d3ed79fd1d9d7bb2e05d5fa089d
-
SSDEEP
12288:L+aV0E3JsEG0hQut+F4pAGdZQ1Sa9+/NXSvy4IvLVOOrvbL9sE84An5+X+r0XwVK:L+aV0E3JdG0hQut+F4pTdZQ1Sa9eSvyv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3816 5a63406b23ff0dc56eea143b13854c7e.exe -
Executes dropped EXE 1 IoCs
pid Process 3816 5a63406b23ff0dc56eea143b13854c7e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3816 5a63406b23ff0dc56eea143b13854c7e.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2276 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3816 5a63406b23ff0dc56eea143b13854c7e.exe 3816 5a63406b23ff0dc56eea143b13854c7e.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2760 5a63406b23ff0dc56eea143b13854c7e.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2760 5a63406b23ff0dc56eea143b13854c7e.exe 3816 5a63406b23ff0dc56eea143b13854c7e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2760 wrote to memory of 3816 2760 5a63406b23ff0dc56eea143b13854c7e.exe 89 PID 2760 wrote to memory of 3816 2760 5a63406b23ff0dc56eea143b13854c7e.exe 89 PID 2760 wrote to memory of 3816 2760 5a63406b23ff0dc56eea143b13854c7e.exe 89 PID 3816 wrote to memory of 2276 3816 5a63406b23ff0dc56eea143b13854c7e.exe 92 PID 3816 wrote to memory of 2276 3816 5a63406b23ff0dc56eea143b13854c7e.exe 92 PID 3816 wrote to memory of 2276 3816 5a63406b23ff0dc56eea143b13854c7e.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe"C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exeC:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5a63406b23ff0dc56eea143b13854c7e.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2276
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD5bb434d197afa7a660f2c3fcb45acb9c4
SHA1fef4330c86547543fc4059abf88f85489c7c2d15
SHA256f55d18b4ae8bfc47dbaaea88a06c00f3ad1d829aaaa94d10d807e0f95b10fdfe
SHA512768eadc8a4d74b868ab95c8c1b74b4cc1788af057899b8782ce13ddf52660e3e9aa01d832c607439d3c7eeab66eab36bcadb122ccf90bd1224070ea29b5be40f