Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 13:01
General
-
Target
7a525b492d5678253fa3f5b38408a1d8.exe
-
Size
506KB
-
MD5
7a525b492d5678253fa3f5b38408a1d8
-
SHA1
1adf8745113b9ec8454bf98ee1b44caaafb70a90
-
SHA256
fcc40608bd203d8611ef32f0a12ba60a60d3de316ba6fc79f3b093517a49ddc0
-
SHA512
b955722d4a93c75bc14a7bee0425884379346b9f3dfad309159f50c7531a5c053a100ac9eb188ffa7f6556edbe286a71a6fefd17638bfdf7344ab6d93c8e2a5d
-
SSDEEP
12288:9HYQh0Za0aMNNnv8123le8Sjxv3PIfSicJ9yjXF3fS:9xuaMNtv8Setv9ibS
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a525b492d5678253fa3f5b38408a1d8.exe"C:\Users\Admin\AppData\Local\Temp\7a525b492d5678253fa3f5b38408a1d8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a525b492d5678253fa3f5b38408a1d8.exeC:\Users\Admin\AppData\Local\Temp\7a525b492d5678253fa3f5b38408a1d8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7a525b492d5678253fa3f5b38408a1d8.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
489KB
MD5f1026953935eaa617809e9e643cc4b2e
SHA12d98d8f245388896f979f951b61152f324ef307a
SHA25691ab9116edc594d4509c6c8ccf7bde7020b7a8ead60f91cd3f956be4cde23eb0
SHA512001620e44f85acccfba90c1d2e13ab6c5afc3acf2367b59cff21091ef9eede3d638d16742b2631a8a7048459bf7e6f3410ab36874de16c49833bdbf14ce4d2c7
-
Filesize
464KB
MD548a4a0ecedb7efb21a6a0deb38d0ef55
SHA1772b52495d6fe90580c02b349a0acc1d5489b53c
SHA256ad5bc4f4e301354f14267e5f7c276fca7f8cc3e21bb382a370d343caa8f8f498
SHA5125342be6ac585342bb7a6b444ac31448325f59237f5dc5c360714cdd0e43c3256452132fe717cc31e5008e9f264ee23741a2ae07b3e6e219ba1e288ef37bcbfa9
-
Filesize
5KB
MD573f101cb474d2101e5ef76e684e3bace
SHA18d7a75e1d3addd0b2b4b394f25c4f59890bde628
SHA2560dfa3f44ecad5dd8e55961e9e87f8fdc4227ead46ad0f318ca52190419b49013
SHA5123a69cfda58907fa7044677dfc2ad77d6bc7377ec93b21651e6bf0367de11bffd1a94111f5b17d6fde3dd3c13999753d389f5300d32f25be6f658a5995b67a95a
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
440KB
MD5c04afc6e846fbafcc0dd8473eb1f061e
SHA1dc86eaa7fdee19bb90377cc73619e656e06817f2
SHA2564f5f735a164bf70bac7be027af8ae88882c383631fa28186b10af4129c82dac4
SHA5126f031716de739cd5db462bc872c73f7f3e1b22abf2e49ca9d9c59f6a5fcd2eb7170b527d31f3a9d25b0e5598653f1e5b8238fb43f618d17b2e0dd0e1e5f0b195
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
364KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
364KB