Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
b84c1bcdfc54998b268bf88a240ef7b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b84c1bcdfc54998b268bf88a240ef7b7.exe
Resource
win10v2004-20240226-en
General
-
Target
b84c1bcdfc54998b268bf88a240ef7b7.exe
-
Size
1000KB
-
MD5
b84c1bcdfc54998b268bf88a240ef7b7
-
SHA1
7fb2603c8dc973af6c279b766c563ace934f9650
-
SHA256
11bc700b26b09c06b0d4317e4e8d0c26a5ca16834480c0ecf6a4f164ef7f88c6
-
SHA512
8646244c8987cbc14606cac589edf286216362230b8e1a8bb162477285544b46faea3107a024939e793815a8d78346e34f739d474482314e24aa247e11b581d3
-
SSDEEP
24576:M+sLP/2wz52q+ia/Z0/9OJ31B+5vMiqt0gj2ed:y/tuZ49OHqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Executes dropped EXE 1 IoCs
pid Process 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Loads dropped DLL 1 IoCs
pid Process 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 7 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2224 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2564 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe 27 PID 2520 wrote to memory of 2564 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe 27 PID 2520 wrote to memory of 2564 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe 27 PID 2520 wrote to memory of 2564 2520 b84c1bcdfc54998b268bf88a240ef7b7.exe 27 PID 2564 wrote to memory of 2224 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe 28 PID 2564 wrote to memory of 2224 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe 28 PID 2564 wrote to memory of 2224 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe 28 PID 2564 wrote to memory of 2224 2564 b84c1bcdfc54998b268bf88a240ef7b7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b84c1bcdfc54998b268bf88a240ef7b7.exe"C:\Users\Admin\AppData\Local\Temp\b84c1bcdfc54998b268bf88a240ef7b7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\b84c1bcdfc54998b268bf88a240ef7b7.exeC:\Users\Admin\AppData\Local\Temp\b84c1bcdfc54998b268bf88a240ef7b7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b84c1bcdfc54998b268bf88a240ef7b7.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2224
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
1000KB
MD538b73556075e7f9e84a9781e2b520179
SHA1f5891787da053fa4429ec9bca017f4579303dfc7
SHA2563f427c41aa1d59e3a96fadc1557cb9e2e745830db71dfd50b029557aaa1d06ea
SHA5123c98d820a331071bfeb8bbb2e8a00110a4af1a6f584e1993262b4b5d5eeeffebdd55b26e766d15ecfc2248f66e977e256b1f1b29d9c3acf1b71db0e81ce7cf20
-
Filesize
64KB
MD5f4204d93734fc90a149bdda9798aec1b
SHA141d4e6099acd8f681334b9ee990205659981e4c6
SHA2563e265266a675891c0b985b9e716395b45d837cc599903285cb3e2a18e17105b3
SHA512c6cbe62a0883a0a98b1034d497b5b3bb1e5706e59c26c076e60a4385fd7925e8323d31a50f6278fa957676e5560b0d467bf66661469382d9db634e20329de3fe