Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
bad7b7a3222f052bfd8ed7954104f06c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bad7b7a3222f052bfd8ed7954104f06c.exe
Resource
win10v2004-20240226-en
General
-
Target
bad7b7a3222f052bfd8ed7954104f06c.exe
-
Size
506KB
-
MD5
bad7b7a3222f052bfd8ed7954104f06c
-
SHA1
d5f4f24607fcbb259dcfe210f1da5129ace7d26d
-
SHA256
4fd2f26df9d5f0fdde23e6d95b335fd7ce13f7ccb609d596f06047d9520956c3
-
SHA512
c5962bfa93868d733a2992c5d5161c2bf56d9ffeacdf99cff5d61097d1cc5421996e84b71a443e67427f589a06aa991ec367d9b0a9cd19a90703c52d648cfda1
-
SSDEEP
12288:Pny1ndrmU1swNl+s/dIJt4yW1x3niTREbvoAwGLL2q0b:PytRmUpl7VIP4yWTgEbhx70b
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2128 bad7b7a3222f052bfd8ed7954104f06c.exe -
Executes dropped EXE 1 IoCs
pid Process 2128 bad7b7a3222f052bfd8ed7954104f06c.exe -
Loads dropped DLL 1 IoCs
pid Process 1636 bad7b7a3222f052bfd8ed7954104f06c.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 7 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2128 bad7b7a3222f052bfd8ed7954104f06c.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2128 bad7b7a3222f052bfd8ed7954104f06c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1636 bad7b7a3222f052bfd8ed7954104f06c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1636 bad7b7a3222f052bfd8ed7954104f06c.exe 2128 bad7b7a3222f052bfd8ed7954104f06c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2128 1636 bad7b7a3222f052bfd8ed7954104f06c.exe 28 PID 1636 wrote to memory of 2128 1636 bad7b7a3222f052bfd8ed7954104f06c.exe 28 PID 1636 wrote to memory of 2128 1636 bad7b7a3222f052bfd8ed7954104f06c.exe 28 PID 1636 wrote to memory of 2128 1636 bad7b7a3222f052bfd8ed7954104f06c.exe 28 PID 2128 wrote to memory of 2532 2128 bad7b7a3222f052bfd8ed7954104f06c.exe 29 PID 2128 wrote to memory of 2532 2128 bad7b7a3222f052bfd8ed7954104f06c.exe 29 PID 2128 wrote to memory of 2532 2128 bad7b7a3222f052bfd8ed7954104f06c.exe 29 PID 2128 wrote to memory of 2532 2128 bad7b7a3222f052bfd8ed7954104f06c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe"C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exeC:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2532
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
506KB
MD553b5d78463edc3ec01b20c7113d4a1a5
SHA1060b32d55745e3ad2a39f139ce1c7637a0ca9521
SHA25652e54255ad9da8bc0df2c352fb21d0b96768ab13f7e65c481a1f0149803bf190
SHA512e25063c8b660ffa0888c2a1ccaa6b53d1633598ede2a166b127ebc6ad3a02df4a41f08a83709b2feeb32f0bc364c24c6903587e827024a8c5d1f8fbabda9e368