Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
90067334cb95dbfedebf32ca2c8607d8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
90067334cb95dbfedebf32ca2c8607d8.exe
Resource
win10v2004-20231215-en
General
-
Target
90067334cb95dbfedebf32ca2c8607d8.exe
-
Size
1000KB
-
MD5
90067334cb95dbfedebf32ca2c8607d8
-
SHA1
c1ccbd5ae43a06ca5550b39e2f4c11782568c4ec
-
SHA256
dd909d698f344c5029a9d119550e091dfbc803457174ab06c7b3242c495711bc
-
SHA512
8ed07b1c3bf9978eae26824aed094a9227800e506adeb803f6d2e95de7f929f4654c4a0e73726d54ad3cdc28c51246704296ef2592cdfb88cd5f688373648251
-
SSDEEP
24576:iew286NHx5ckQpeeXt8b1B+5vMiqt0gj2ed:9w5qjBQpf98zqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2200 90067334cb95dbfedebf32ca2c8607d8.exe -
Executes dropped EXE 1 IoCs
pid Process 2200 90067334cb95dbfedebf32ca2c8607d8.exe -
Loads dropped DLL 1 IoCs
pid Process 2932 90067334cb95dbfedebf32ca2c8607d8.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 7 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2200 90067334cb95dbfedebf32ca2c8607d8.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2200 90067334cb95dbfedebf32ca2c8607d8.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2932 90067334cb95dbfedebf32ca2c8607d8.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2932 90067334cb95dbfedebf32ca2c8607d8.exe 2200 90067334cb95dbfedebf32ca2c8607d8.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2200 2932 90067334cb95dbfedebf32ca2c8607d8.exe 16 PID 2932 wrote to memory of 2200 2932 90067334cb95dbfedebf32ca2c8607d8.exe 16 PID 2932 wrote to memory of 2200 2932 90067334cb95dbfedebf32ca2c8607d8.exe 16 PID 2932 wrote to memory of 2200 2932 90067334cb95dbfedebf32ca2c8607d8.exe 16 PID 2200 wrote to memory of 1908 2200 90067334cb95dbfedebf32ca2c8607d8.exe 15 PID 2200 wrote to memory of 1908 2200 90067334cb95dbfedebf32ca2c8607d8.exe 15 PID 2200 wrote to memory of 1908 2200 90067334cb95dbfedebf32ca2c8607d8.exe 15 PID 2200 wrote to memory of 1908 2200 90067334cb95dbfedebf32ca2c8607d8.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\90067334cb95dbfedebf32ca2c8607d8.exe"C:\Users\Admin\AppData\Local\Temp\90067334cb95dbfedebf32ca2c8607d8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\90067334cb95dbfedebf32ca2c8607d8.exeC:\Users\Admin\AppData\Local\Temp\90067334cb95dbfedebf32ca2c8607d8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2200
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\90067334cb95dbfedebf32ca2c8607d8.exe" /TN Google_Trk_Updater /F1⤵
- Creates scheduled task(s)
PID:1908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
272KB
MD59f8aa941a5f0c6eeb53f131c45c4483b
SHA166568dfb7aa86dd97a22ab31e81b821c987ffd28
SHA2567366aef4d0b0258af89d7c99a3a8b7f04fedc9d3a0a4979e37bb40ba774d8bea
SHA512998dee34a8ca8e37f12d496f17ea5896caae3c32365568e9f507309d36bad096341aa4068bdf2ac09c9508c1462aa00dbc0ed80a4c670a4831b0e1ad45f95c6f
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
313KB
MD50f40e55470e21d9592087a72c3205f3b
SHA14278a00432447cbfd39081b00c5dd1b9033c5588
SHA256a4c53381d3b6bc6ca7bf01b790bfb339ecac5f9950b2e829b9d9caa014d6cf09
SHA5126c202fb041d41c207f03bcbfe2019e4399f303e327540d77ef3e180da22e3b16d755ef5646fa6ed911c392fe273e673b1bc0b40410b002183ab9e8a5fec87b1f