Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe
Resource
win7-20240704-en
General
-
Target
49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe
-
Size
368KB
-
MD5
28786e22c0b0cac8ef6b24db706b5e07
-
SHA1
16f77c1e6a4a253c5294d844426213eaf4a8d4cd
-
SHA256
49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868
-
SHA512
fa15b6e979bb523987b0e89469fb85cedc1713ecccca78f912f098661dcb41456f6fc49e283b653cdea79ca877ea8630cb84ea2ff3bacfd1447e6384759709bf
-
SSDEEP
6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qk:emSuOcHmnYhrDMTrban4qk
Malware Config
Signatures
-
Trickbot x86 loader 6 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/1560-1-0x00000000006C0000-0x00000000006E9000-memory.dmp trickbot_loader32 behavioral2/memory/1560-6-0x00000000006C0000-0x00000000006E9000-memory.dmp trickbot_loader32 behavioral2/memory/4000-9-0x0000000000790000-0x00000000007B9000-memory.dmp trickbot_loader32 behavioral2/memory/4000-24-0x0000000000790000-0x00000000007B9000-memory.dmp trickbot_loader32 behavioral2/memory/3168-28-0x0000000000380000-0x00000000003A9000-memory.dmp trickbot_loader32 behavioral2/memory/3168-42-0x0000000000380000-0x00000000003A9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1560 wrote to memory of 4000 1560 49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe 83 PID 1560 wrote to memory of 4000 1560 49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe 83 PID 1560 wrote to memory of 4000 1560 49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe 83 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 4000 wrote to memory of 1992 4000 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 84 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 PID 3168 wrote to memory of 4836 3168 49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe"C:\Users\Admin\AppData\Local\Temp\49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exeC:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1992
-
-
-
C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exeC:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-771719357-2485960699-3367710044-1000\0f5007522459c86e95ffcc62f32308f1_35358dd3-bd93-4b0e-873a-19f920cbeaf2
Filesize1KB
MD573aa991d416a471fa0135176f97f4d03
SHA1588f57a3d4dc480f499e05ca8b8f216c112a22cd
SHA2560767ca6c4c77e92dd1dabef6723215d46f4844408e83e85f692a6fa1800e1e02
SHA512d18d52cc447afaa177855e25473f11f03041c5f16899330a9ad73b401568677cd9b804d911b31315c1c4cbb6bafd774fb4767c5b3ccacf22ba9fa5bc33dfe09c
-
C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe
Filesize368KB
MD528786e22c0b0cac8ef6b24db706b5e07
SHA116f77c1e6a4a253c5294d844426213eaf4a8d4cd
SHA25649fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868
SHA512fa15b6e979bb523987b0e89469fb85cedc1713ecccca78f912f098661dcb41456f6fc49e283b653cdea79ca877ea8630cb84ea2ff3bacfd1447e6384759709bf