Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
cc40855c45c364e9b87b5f15635c9ad7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cc40855c45c364e9b87b5f15635c9ad7.exe
Resource
win10v2004-20231215-en
General
-
Target
cc40855c45c364e9b87b5f15635c9ad7.exe
-
Size
1000KB
-
MD5
cc40855c45c364e9b87b5f15635c9ad7
-
SHA1
e78e5724170a8d1a160f2734f3d68d4312f14ee2
-
SHA256
404420d23348b4f6163d409ed2381056c6319e9f492b9a4a5b0f6b28a132ee0a
-
SHA512
d0cf05bba23750d4d3dc365d7e87a30ee390556069d11225f29e466e4db46d64f3976964ea7fe03ff57f8e3014184b7cfef0bfb3bef70f4ce4a9a2e49ad50782
-
SSDEEP
24576:aNd2/xq6VecWfa5sHGdqRDoeY7d15ipq1B+5vMiqt0gj2ed:aY/xq64Vfa5sHGdqRDoeY7dvipgqOL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 368 cc40855c45c364e9b87b5f15635c9ad7.exe -
Executes dropped EXE 1 IoCs
pid Process 368 cc40855c45c364e9b87b5f15635c9ad7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 pastebin.com 20 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 368 cc40855c45c364e9b87b5f15635c9ad7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 368 cc40855c45c364e9b87b5f15635c9ad7.exe 368 cc40855c45c364e9b87b5f15635c9ad7.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5068 cc40855c45c364e9b87b5f15635c9ad7.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 5068 cc40855c45c364e9b87b5f15635c9ad7.exe 368 cc40855c45c364e9b87b5f15635c9ad7.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5068 wrote to memory of 368 5068 cc40855c45c364e9b87b5f15635c9ad7.exe 85 PID 5068 wrote to memory of 368 5068 cc40855c45c364e9b87b5f15635c9ad7.exe 85 PID 5068 wrote to memory of 368 5068 cc40855c45c364e9b87b5f15635c9ad7.exe 85 PID 368 wrote to memory of 3688 368 cc40855c45c364e9b87b5f15635c9ad7.exe 86 PID 368 wrote to memory of 3688 368 cc40855c45c364e9b87b5f15635c9ad7.exe 86 PID 368 wrote to memory of 3688 368 cc40855c45c364e9b87b5f15635c9ad7.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe"C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exeC:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\cc40855c45c364e9b87b5f15635c9ad7.exe" /TN Google_Trk_Updater /F3⤵
- Creates scheduled task(s)
PID:3688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD50ea73b9884c6bc49b92d8af33e52138c
SHA1ba7c66550ac0e9b7741c762cfe95a896fc13fbc4
SHA2562a11bf1bf955360a1c9affb078804d272a2c663aaa54d74cc4bfb246e61d859b
SHA512089d317153f7bddd281b65404065fd15d030af22162cefa339a8c983606062b9abac49b40440f483eaf839d348aa2c7cda14e99ce56d82ea75c54de40bb5f000