Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
01/02/2024, 22:28
General
-
Target
87d41e3c36eb1c75172e3183b05a9a34.exe
-
Size
1000KB
-
MD5
87d41e3c36eb1c75172e3183b05a9a34
-
SHA1
5db1be24b938d72557fc2bb97de16fc388ba051b
-
SHA256
b3677abdb0059cce8678249bd498b5471b8fb1a947aaa597511628bd8946a416
-
SHA512
0970d6bbdd4739cc2a4528d76b07d9b87b6504b169aabc0875c01c6e99b6fc06ebb3807eb51af8836e33ee91c758cc6c465c9a90cfe7785e3c421a44970c7d9f
-
SSDEEP
24576:FhKe8Kc4BhLMSjZxObfl+dl7L3fX+1B+5vMiqt0gj2ed:FhKet3BmSt8fl+dlnPXMqOL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d41e3c36eb1c75172e3183b05a9a34.exe"C:\Users\Admin\AppData\Local\Temp\87d41e3c36eb1c75172e3183b05a9a34.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\87d41e3c36eb1c75172e3183b05a9a34.exeC:\Users\Admin\AppData\Local\Temp\87d41e3c36eb1c75172e3183b05a9a34.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\87d41e3c36eb1c75172e3183b05a9a34.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
589KB
MD5dcce78a370d79528bd70ba56bff89600
SHA1fb5b5c4218cfa79dec1dbf3c3b8610658c3afebb
SHA25624267c0bc73715eb686247ca1b164f665b06209c3e562beeb505e0aa9081ca47
SHA51260083d6deacbb3b361156021c3a93162a338b5cea09f83874cb08305f235f9bdae24923ba23c94ad43454221a7c96e6b598f21aebd60447c3599141778d82b24
-
Filesize
504KB
MD59e19d6d85ed59d9bfd6b453f6298e36c
SHA1c40d69f90cb036c09ac7348e2cf7d291c6ec8da8
SHA2567b8070637363e89ea9949d4eb53ab45235f05adab7bee4a03208a9e843f56f27
SHA512e2d736c90080f6b9bf0f6598dddbd593c150447576036bb762f8429e846e81526d98a5e7b7544b72aecef0bf8da95761293aa6c3c8bf07c33f0bf77e7512de01
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
638KB
MD56813d2d9f7c01a6421c2fab1065c9c03
SHA1f2a82b1c0b863ed14a2512946aa32d7386ae778e
SHA256608ab0347e46f9ed714f6b92a4461fdffd1b0dd0b6eaf72df371573431f5bfe3
SHA512134f7b0a01625b3f0cc3dc47e835034d046677fe670be80287e41cdc0bdd2f1a2c5800b8a14e60341a04853e3380cca539da8df3ce6f141b977468a01ce1b375
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
504KB
-
Filesize
524KB
-
Filesize
504KB