Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 19:26

General

  • Target

    6871d68fc9547a93eb657f774dc1950f.exe

  • Size

    1000KB

  • MD5

    6871d68fc9547a93eb657f774dc1950f

  • SHA1

    decbe7edadfbf8045357505bcdc035921976d32c

  • SHA256

    da080661795e3d9c4bd0de1880d726890c4a6e9b090698ab62b5cdbe140f0ab0

  • SHA512

    debbb30d32f1fb023b1a0799c9c5b20422c234a19d0efae4f84c0e061216acd8dbe891deab9bd5025bd42a11294206608a404f4184980ec7a00ccb779c18ff8e

  • SSDEEP

    24576:fMS3ZxVrFoYuE/cO4ue1B+5vMiqt0gj2ed:0S3XhFoYT/GusqOL

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe
    "C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe
      C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe" /TN Google_Trk_Updater /F
        3⤵
        • Creates scheduled task(s)
        PID:1268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6871d68fc9547a93eb657f774dc1950f.exe

    Filesize

    1000KB

    MD5

    883a7a80ef5f6005f568b6bf1cfc7263

    SHA1

    3567e319146f5828e7630ab6f4de54928ed650b8

    SHA256

    e67b8a9c585159d3abc8fe0921e9e34fbf36697e7aab849484accd864a95236e

    SHA512

    1305e010a187565c83bb60588352c31883ff5a525d2a17bca1269e30839c27071089822380fcea262d3fdb7e09449faedd494ab1ba1fed2a806e09aa15acb442

  • memory/456-13-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/456-14-0x0000000001510000-0x0000000001593000-memory.dmp

    Filesize

    524KB

  • memory/456-21-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/456-20-0x0000000004F00000-0x0000000004F7E000-memory.dmp

    Filesize

    504KB

  • memory/456-27-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1892-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1892-1-0x00000000016A0000-0x0000000001723000-memory.dmp

    Filesize

    524KB

  • memory/1892-2-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/1892-11-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB