Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
cc40855c45c364e9b87b5f15635c9ad7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cc40855c45c364e9b87b5f15635c9ad7.exe
Resource
win10v2004-20231215-en
General
-
Target
cc40855c45c364e9b87b5f15635c9ad7.exe
-
Size
1000KB
-
MD5
cc40855c45c364e9b87b5f15635c9ad7
-
SHA1
e78e5724170a8d1a160f2734f3d68d4312f14ee2
-
SHA256
404420d23348b4f6163d409ed2381056c6319e9f492b9a4a5b0f6b28a132ee0a
-
SHA512
d0cf05bba23750d4d3dc365d7e87a30ee390556069d11225f29e466e4db46d64f3976964ea7fe03ff57f8e3014184b7cfef0bfb3bef70f4ce4a9a2e49ad50782
-
SSDEEP
24576:aNd2/xq6VecWfa5sHGdqRDoeY7d15ipq1B+5vMiqt0gj2ed:aY/xq64Vfa5sHGdqRDoeY7dvipgqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2788 cc40855c45c364e9b87b5f15635c9ad7.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 cc40855c45c364e9b87b5f15635c9ad7.exe -
Loads dropped DLL 1 IoCs
pid Process 2916 cc40855c45c364e9b87b5f15635c9ad7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 7 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2788 cc40855c45c364e9b87b5f15635c9ad7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2788 cc40855c45c364e9b87b5f15635c9ad7.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2916 cc40855c45c364e9b87b5f15635c9ad7.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2916 cc40855c45c364e9b87b5f15635c9ad7.exe 2788 cc40855c45c364e9b87b5f15635c9ad7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2788 2916 cc40855c45c364e9b87b5f15635c9ad7.exe 28 PID 2916 wrote to memory of 2788 2916 cc40855c45c364e9b87b5f15635c9ad7.exe 28 PID 2916 wrote to memory of 2788 2916 cc40855c45c364e9b87b5f15635c9ad7.exe 28 PID 2916 wrote to memory of 2788 2916 cc40855c45c364e9b87b5f15635c9ad7.exe 28 PID 2788 wrote to memory of 2588 2788 cc40855c45c364e9b87b5f15635c9ad7.exe 29 PID 2788 wrote to memory of 2588 2788 cc40855c45c364e9b87b5f15635c9ad7.exe 29 PID 2788 wrote to memory of 2588 2788 cc40855c45c364e9b87b5f15635c9ad7.exe 29 PID 2788 wrote to memory of 2588 2788 cc40855c45c364e9b87b5f15635c9ad7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe"C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exeC:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
1000KB
MD59803408fdc708152a08884737e012196
SHA106b94c1625736a7d47f021dd86769dfac44a9e2c
SHA256be5e69edfeafaed072365d9fd778f0258a8cd11069ef598258f2593d49b31a86
SHA51205ee866918d2af3a84e21360bd2695f3da4e94d08d2a0785e341ecce97134fc15579eb610ccb61dafa52a686295e96b0a0a306e8240fb733924db6c7f033b803