Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
a26f20c9cd29e95483b6ef09b803e06a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a26f20c9cd29e95483b6ef09b803e06a.exe
Resource
win10v2004-20240221-en
General
-
Target
a26f20c9cd29e95483b6ef09b803e06a.exe
-
Size
1000KB
-
MD5
a26f20c9cd29e95483b6ef09b803e06a
-
SHA1
89c13534db06efa0b702835f43652b23e1db1fd8
-
SHA256
8f390ad5f6ebbc03cfd4810fcff60605b63f2c96b0dbec0b1cf9cbe05fa93673
-
SHA512
63ca630e1c3a38e57abe314c3281a0dee310fa5203eeb5850e815a751982ca414a029ad15a68863717ddc5ae7636f6af8ff6e2a3545a38a89fdf1e895697ffc4
-
SSDEEP
24576:3b2AW9Icck/sVDtC2NR1B+5vMiqt0gj2ed:L2AWOk/sVDtRtqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 332 a26f20c9cd29e95483b6ef09b803e06a.exe -
Executes dropped EXE 1 IoCs
pid Process 332 a26f20c9cd29e95483b6ef09b803e06a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 pastebin.com 18 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 332 a26f20c9cd29e95483b6ef09b803e06a.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5100 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 332 a26f20c9cd29e95483b6ef09b803e06a.exe 332 a26f20c9cd29e95483b6ef09b803e06a.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3224 a26f20c9cd29e95483b6ef09b803e06a.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3224 a26f20c9cd29e95483b6ef09b803e06a.exe 332 a26f20c9cd29e95483b6ef09b803e06a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3224 wrote to memory of 332 3224 a26f20c9cd29e95483b6ef09b803e06a.exe 87 PID 3224 wrote to memory of 332 3224 a26f20c9cd29e95483b6ef09b803e06a.exe 87 PID 3224 wrote to memory of 332 3224 a26f20c9cd29e95483b6ef09b803e06a.exe 87 PID 332 wrote to memory of 5100 332 a26f20c9cd29e95483b6ef09b803e06a.exe 91 PID 332 wrote to memory of 5100 332 a26f20c9cd29e95483b6ef09b803e06a.exe 91 PID 332 wrote to memory of 5100 332 a26f20c9cd29e95483b6ef09b803e06a.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26f20c9cd29e95483b6ef09b803e06a.exe"C:\Users\Admin\AppData\Local\Temp\a26f20c9cd29e95483b6ef09b803e06a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\a26f20c9cd29e95483b6ef09b803e06a.exeC:\Users\Admin\AppData\Local\Temp\a26f20c9cd29e95483b6ef09b803e06a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\a26f20c9cd29e95483b6ef09b803e06a.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:5100
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD5befbcd5fdbc67a7d88aa9475e39f4d1f
SHA18d754f0f44994ad7f24913b4da8472110fc52e28
SHA256df757e809117c888793513e750281606c072965501f66a6341656b3bcf72f52d
SHA5128c250a7958b7c31da8ebf5873ddeba1b678df99b4e2af6bedacd59d6bbde4d9ef148af6b72535249ab3967e1a7620574f8e5919a84768ec809f8a5a5980cd525