Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
6871d68fc9547a93eb657f774dc1950f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6871d68fc9547a93eb657f774dc1950f.exe
Resource
win10v2004-20231222-en
General
-
Target
6871d68fc9547a93eb657f774dc1950f.exe
-
Size
1000KB
-
MD5
6871d68fc9547a93eb657f774dc1950f
-
SHA1
decbe7edadfbf8045357505bcdc035921976d32c
-
SHA256
da080661795e3d9c4bd0de1880d726890c4a6e9b090698ab62b5cdbe140f0ab0
-
SHA512
debbb30d32f1fb023b1a0799c9c5b20422c234a19d0efae4f84c0e061216acd8dbe891deab9bd5025bd42a11294206608a404f4184980ec7a00ccb779c18ff8e
-
SSDEEP
24576:fMS3ZxVrFoYuE/cO4ue1B+5vMiqt0gj2ed:0S3XhFoYT/GusqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 456 6871d68fc9547a93eb657f774dc1950f.exe -
Executes dropped EXE 1 IoCs
pid Process 456 6871d68fc9547a93eb657f774dc1950f.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 456 6871d68fc9547a93eb657f774dc1950f.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1268 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 456 6871d68fc9547a93eb657f774dc1950f.exe 456 6871d68fc9547a93eb657f774dc1950f.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1892 6871d68fc9547a93eb657f774dc1950f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1892 6871d68fc9547a93eb657f774dc1950f.exe 456 6871d68fc9547a93eb657f774dc1950f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1892 wrote to memory of 456 1892 6871d68fc9547a93eb657f774dc1950f.exe 89 PID 1892 wrote to memory of 456 1892 6871d68fc9547a93eb657f774dc1950f.exe 89 PID 1892 wrote to memory of 456 1892 6871d68fc9547a93eb657f774dc1950f.exe 89 PID 456 wrote to memory of 1268 456 6871d68fc9547a93eb657f774dc1950f.exe 91 PID 456 wrote to memory of 1268 456 6871d68fc9547a93eb657f774dc1950f.exe 91 PID 456 wrote to memory of 1268 456 6871d68fc9547a93eb657f774dc1950f.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe"C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exeC:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:1268
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD5883a7a80ef5f6005f568b6bf1cfc7263
SHA13567e319146f5828e7630ab6f4de54928ed650b8
SHA256e67b8a9c585159d3abc8fe0921e9e34fbf36697e7aab849484accd864a95236e
SHA5121305e010a187565c83bb60588352c31883ff5a525d2a17bca1269e30839c27071089822380fcea262d3fdb7e09449faedd494ab1ba1fed2a806e09aa15acb442