Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29/01/2024, 16:07 UTC
General
-
Target
8044af50fe95c7ed15532c1464d5dc1d.exe
-
Size
506KB
-
MD5
8044af50fe95c7ed15532c1464d5dc1d
-
SHA1
3bd680036d9b5445ae37537a43cac2aa337dde1a
-
SHA256
33d4a48e121734c624ef1f5cc6819e7e546041943b540bdb2d9acb38c54b72bd
-
SHA512
c82175219ba3e7f912621372a3959df0172def08197989560d93be1e4a42e90dca179cdc8cafc6b15583377faac24bbf612c17efb57f49a336be068335634910
-
SSDEEP
12288:q6SxVwOuj3wrQvWNx1oxtj8LGVciJNHoeRIgOdn:q6Sx6Osgs8foxtj8LGVciJrRIgOdn
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8044af50fe95c7ed15532c1464d5dc1d.exe"C:\Users\Admin\AppData\Local\Temp\8044af50fe95c7ed15532c1464d5dc1d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8044af50fe95c7ed15532c1464d5dc1d.exeC:\Users\Admin\AppData\Local\Temp\8044af50fe95c7ed15532c1464d5dc1d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\8044af50fe95c7ed15532c1464d5dc1d.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
-
DNSwww.EwXYW0p4is.comRemote address:8.8.8.8:53Requestwww.EwXYW0p4is.comIN AResponse -
DNSw.google.comRemote address:8.8.8.8:53Requestw.google.comIN AResponsew.google.comIN CNAMEwww3.l.google.comwww3.l.google.comIN A172.217.18.206
-
GEThttp://w.google.com/Remote address:172.217.18.206:80RequestGET / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*, ???@, ??????????????
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Host: w.google.com
ResponseHTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Referrer-Policy: no-referrer
Content-Length: 1561
Date: Mon, 29 Jan 2024 16:07:26 GMT
-
DNSpastebin.comRemote address:8.8.8.8:53Requestpastebin.comIN AResponsepastebin.comIN A172.67.34.170pastebin.comIN A104.20.67.143pastebin.comIN A104.20.68.143
-
GEThttp://pastebin.com/raw/ubFNTPjtRemote address:172.67.34.170:80RequestGET /raw/ubFNTPjt HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*, ???@, ??????????????
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Host: pastebin.com
ResponseHTTP/1.1 301 Moved Permanently
Date: Mon, 29 Jan 2024 16:07:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Mon, 29 Jan 2024 17:07:26 GMT
Location: https://pastebin.com/raw/ubFNTPjt
Server: cloudflare
CF-RAY: 84d2ba68add363b4-LHR
-
GEThttps://pastebin.com/raw/ubFNTPjtRemote address:172.67.34.170:443RequestGET /raw/ubFNTPjt HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*, ???@, ??????????????
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Host: pastebin.com
ResponseHTTP/1.1 404 Not Found
Date: Mon, 29 Jan 2024 16:07:27 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
x-frame-options: DENY
x-frame-options: DENY
x-content-type-options: nosniff
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
x-xss-protection: 1;mode=block
cache-control: public, max-age=1801
CF-Cache-Status: HIT
Age: 1342
Server: cloudflare
CF-RAY: 84d2ba6e28926347-LHR
-
172.217.18.206:80http://w.google.com/http
HTTP Request
GET http://w.google.com/HTTP Response
404 -
172.67.34.170:80http://pastebin.com/raw/ubFNTPjthttp
HTTP Request
GET http://pastebin.com/raw/ubFNTPjtHTTP Response
301 -
172.67.34.170:443https://pastebin.com/raw/ubFNTPjttls, http
HTTP Request
GET https://pastebin.com/raw/ubFNTPjtHTTP Response
404
-
8.8.8.8:53www.EwXYW0p4is.comdns
DNS Request
www.EwXYW0p4is.com
-
8.8.8.8:53w.google.comdns
DNS Request
w.google.com
DNS Response
172.217.18.206
-
8.8.8.8:53pastebin.comdns
DNS Request
pastebin.com
DNS Response
172.67.34.170104.20.67.143104.20.68.143
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
506KB
MD54f9072597ce2b3b39d0160fb00bfade2
SHA1c5a65df9502cd7c27e1901e61cd62b0213de5e9f
SHA2569f6a6aad45c850d1f39173f052ca51291d7bcd9044c88033c9b1d093418c0ac3
SHA5120285513272a67e77b77290cf6ff76c0f431b59f2cb329fff11f358b1b049d1abb2096c520f72642c26c7172fd88f45b8b9ad0ee5500a5191167f907f62f3a536
-
Filesize
524KB
-
Filesize
364KB
-
Filesize
504KB
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB