Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 21:43
Static task
static1
Behavioral task
behavioral1
Sample
b8438756f82f3b5c123a8fa9b0bb8406.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b8438756f82f3b5c123a8fa9b0bb8406.exe
Resource
win10v2004-20240226-en
General
-
Target
b8438756f82f3b5c123a8fa9b0bb8406.exe
-
Size
506KB
-
MD5
b8438756f82f3b5c123a8fa9b0bb8406
-
SHA1
9b19341767887f49d1e6d8f526a8ee773751c4de
-
SHA256
a9f1687663f42e1642217e53483184f2204ae1b57da7ec682dbf0a9bcb7622d9
-
SHA512
3eb932c848f89ee24b64bb357baebe7bdf86bfef33cb15a45d222032bba94aed5bc46f2de45941f77507d778891098ff313aeb0aa67bed869d12863002d2ae5f
-
SSDEEP
12288:5ZLYvmkopWAS2ydZ1QSg94AKGWzg1hdLVeHtct:5ZLGohS7QSSjIU3dLcNct
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe -
Executes dropped EXE 1 IoCs
pid Process 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 17 pastebin.com 23 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3864 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4816 b8438756f82f3b5c123a8fa9b0bb8406.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4816 b8438756f82f3b5c123a8fa9b0bb8406.exe 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4212 4816 b8438756f82f3b5c123a8fa9b0bb8406.exe 88 PID 4816 wrote to memory of 4212 4816 b8438756f82f3b5c123a8fa9b0bb8406.exe 88 PID 4816 wrote to memory of 4212 4816 b8438756f82f3b5c123a8fa9b0bb8406.exe 88 PID 4212 wrote to memory of 3864 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe 91 PID 4212 wrote to memory of 3864 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe 91 PID 4212 wrote to memory of 3864 4212 b8438756f82f3b5c123a8fa9b0bb8406.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe"C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exeC:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b8438756f82f3b5c123a8fa9b0bb8406.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:3864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD52fd4a061042378ecb33d1b30ecb0aea1
SHA1a20b49a2d7d8cb6a71972800f8e018e7ba94ea67
SHA256883baa84503a2018546bd26c84a87531b67ee006d9b37e1b5f7b7380dbaa1238
SHA5128adedd59d609fcb12e08b1d3f4bb07e32a3187cb9ae24adf6d147c0715fe4324dfa8636ba7a30bc7619740a349b9e45cafb2c9d5d91522a58e6edc5144d7f670