Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
bad7b7a3222f052bfd8ed7954104f06c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bad7b7a3222f052bfd8ed7954104f06c.exe
Resource
win10v2004-20240226-en
General
-
Target
bad7b7a3222f052bfd8ed7954104f06c.exe
-
Size
506KB
-
MD5
bad7b7a3222f052bfd8ed7954104f06c
-
SHA1
d5f4f24607fcbb259dcfe210f1da5129ace7d26d
-
SHA256
4fd2f26df9d5f0fdde23e6d95b335fd7ce13f7ccb609d596f06047d9520956c3
-
SHA512
c5962bfa93868d733a2992c5d5161c2bf56d9ffeacdf99cff5d61097d1cc5421996e84b71a443e67427f589a06aa991ec367d9b0a9cd19a90703c52d648cfda1
-
SSDEEP
12288:Pny1ndrmU1swNl+s/dIJt4yW1x3niTREbvoAwGLL2q0b:PytRmUpl7VIP4yWTgEbhx70b
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4016 bad7b7a3222f052bfd8ed7954104f06c.exe -
Executes dropped EXE 1 IoCs
pid Process 4016 bad7b7a3222f052bfd8ed7954104f06c.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 19 pastebin.com 24 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4016 bad7b7a3222f052bfd8ed7954104f06c.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4916 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4016 bad7b7a3222f052bfd8ed7954104f06c.exe 4016 bad7b7a3222f052bfd8ed7954104f06c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4956 bad7b7a3222f052bfd8ed7954104f06c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4956 bad7b7a3222f052bfd8ed7954104f06c.exe 4016 bad7b7a3222f052bfd8ed7954104f06c.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4016 4956 bad7b7a3222f052bfd8ed7954104f06c.exe 88 PID 4956 wrote to memory of 4016 4956 bad7b7a3222f052bfd8ed7954104f06c.exe 88 PID 4956 wrote to memory of 4016 4956 bad7b7a3222f052bfd8ed7954104f06c.exe 88 PID 4016 wrote to memory of 4916 4016 bad7b7a3222f052bfd8ed7954104f06c.exe 91 PID 4016 wrote to memory of 4916 4016 bad7b7a3222f052bfd8ed7954104f06c.exe 91 PID 4016 wrote to memory of 4916 4016 bad7b7a3222f052bfd8ed7954104f06c.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe"C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exeC:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\bad7b7a3222f052bfd8ed7954104f06c.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:4916
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD5cdad864f93a6ff11893e6042cccc8151
SHA17eebd06642dc173c98f16fcbfa94434684a88ef5
SHA25696a6cd5e941001b12c0136318b844fd9feef9a8da9e92591560c3f28ca22fe96
SHA512a38ea57d951328c45a7f96c8e40cb070de0c48b64dad8de211ad79d1ee369f3f594f4a6de37cc3deb0aa9039f1e4ce5cf6c5debc8f144b797e9353a9af06bad6