Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
c9a03a5585c527f53c3896a494da9a7a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c9a03a5585c527f53c3896a494da9a7a.exe
Resource
win10v2004-20240226-en
General
-
Target
c9a03a5585c527f53c3896a494da9a7a.exe
-
Size
1000KB
-
MD5
c9a03a5585c527f53c3896a494da9a7a
-
SHA1
d67b21d86bb1a1a158133fa8b72d5346e59d08fd
-
SHA256
40e1b2179a2a33b3dd81164a3d11d29d3b00f76f060acae151233dfcc45db3d8
-
SHA512
2757abf60dd40623dd252ecc26c9b07412e9c6bcd131db9ef4f6e90c93a8b1f85b44fceb3d89a4ae93d04947d7e8543a107f649cc4d814d0667509eed2d54b16
-
SSDEEP
24576:S9pnisPF1SOnZR8aQ2Y+PGAvFA1B+5vMiqt0gj2ed:UiYn78anFKqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2988 c9a03a5585c527f53c3896a494da9a7a.exe -
Executes dropped EXE 1 IoCs
pid Process 2988 c9a03a5585c527f53c3896a494da9a7a.exe -
Loads dropped DLL 1 IoCs
pid Process 2956 c9a03a5585c527f53c3896a494da9a7a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 8 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2988 c9a03a5585c527f53c3896a494da9a7a.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2660 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2988 c9a03a5585c527f53c3896a494da9a7a.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2956 c9a03a5585c527f53c3896a494da9a7a.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2956 c9a03a5585c527f53c3896a494da9a7a.exe 2988 c9a03a5585c527f53c3896a494da9a7a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2988 2956 c9a03a5585c527f53c3896a494da9a7a.exe 28 PID 2956 wrote to memory of 2988 2956 c9a03a5585c527f53c3896a494da9a7a.exe 28 PID 2956 wrote to memory of 2988 2956 c9a03a5585c527f53c3896a494da9a7a.exe 28 PID 2956 wrote to memory of 2988 2956 c9a03a5585c527f53c3896a494da9a7a.exe 28 PID 2988 wrote to memory of 2660 2988 c9a03a5585c527f53c3896a494da9a7a.exe 29 PID 2988 wrote to memory of 2660 2988 c9a03a5585c527f53c3896a494da9a7a.exe 29 PID 2988 wrote to memory of 2660 2988 c9a03a5585c527f53c3896a494da9a7a.exe 29 PID 2988 wrote to memory of 2660 2988 c9a03a5585c527f53c3896a494da9a7a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9a03a5585c527f53c3896a494da9a7a.exe"C:\Users\Admin\AppData\Local\Temp\c9a03a5585c527f53c3896a494da9a7a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\c9a03a5585c527f53c3896a494da9a7a.exeC:\Users\Admin\AppData\Local\Temp\c9a03a5585c527f53c3896a494da9a7a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c9a03a5585c527f53c3896a494da9a7a.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
1000KB
MD532b40887b5d63c117516993579d79a7c
SHA1d9c201827df52e74d72e3edf6f379ba9ea12be96
SHA256fd039585e890f608ae872d164913ec3116906d8795fffcb9dabe5376e2a96c09
SHA512b7d1e36b32d90a0863ef7422f4a54cd2e2b8d39b76bacf0e6b1aa07212391e0d5e7f8b581b87b6d6b44dc583b325d489ea47f58b47f51608089b279c5fcd86a1