Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 22:10

General

  • Target

    49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe

  • Size

    368KB

  • MD5

    28786e22c0b0cac8ef6b24db706b5e07

  • SHA1

    16f77c1e6a4a253c5294d844426213eaf4a8d4cd

  • SHA256

    49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868

  • SHA512

    fa15b6e979bb523987b0e89469fb85cedc1713ecccca78f912f098661dcb41456f6fc49e283b653cdea79ca877ea8630cb84ea2ff3bacfd1447e6384759709bf

  • SSDEEP

    6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qk:emSuOcHmnYhrDMTrban4qk

Score
10/10

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 6 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe
    "C:\Users\Admin\AppData\Local\Temp\49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe
      C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1992
    • C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe
      C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3168
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:4836

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-771719357-2485960699-3367710044-1000\0f5007522459c86e95ffcc62f32308f1_35358dd3-bd93-4b0e-873a-19f920cbeaf2

        Filesize

        1KB

        MD5

        73aa991d416a471fa0135176f97f4d03

        SHA1

        588f57a3d4dc480f499e05ca8b8f216c112a22cd

        SHA256

        0767ca6c4c77e92dd1dabef6723215d46f4844408e83e85f692a6fa1800e1e02

        SHA512

        d18d52cc447afaa177855e25473f11f03041c5f16899330a9ad73b401568677cd9b804d911b31315c1c4cbb6bafd774fb4767c5b3ccacf22ba9fa5bc33dfe09c

      • C:\Users\Admin\AppData\Roaming\WNetval\49fcc4994700b23d4190c99122d86c3c984fc2e24144cbee949dfde173678979.exe

        Filesize

        368KB

        MD5

        28786e22c0b0cac8ef6b24db706b5e07

        SHA1

        16f77c1e6a4a253c5294d844426213eaf4a8d4cd

        SHA256

        49fcc4984600b23d4180c89122d75c3c974fc2e24144cbee948dfde163567868

        SHA512

        fa15b6e979bb523987b0e89469fb85cedc1713ecccca78f912f098661dcb41456f6fc49e283b653cdea79ca877ea8630cb84ea2ff3bacfd1447e6384759709bf

      • memory/1560-6-0x00000000006C0000-0x00000000006E9000-memory.dmp

        Filesize

        164KB

      • memory/1560-1-0x00000000006C0000-0x00000000006E9000-memory.dmp

        Filesize

        164KB

      • memory/1992-17-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/1992-16-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/1992-21-0x00000139FB1F0000-0x00000139FB1F1000-memory.dmp

        Filesize

        4KB

      • memory/3168-28-0x0000000000380000-0x00000000003A9000-memory.dmp

        Filesize

        164KB

      • memory/3168-42-0x0000000000380000-0x00000000003A9000-memory.dmp

        Filesize

        164KB

      • memory/3168-41-0x00000000012F0000-0x00000000015B9000-memory.dmp

        Filesize

        2.8MB

      • memory/3168-40-0x0000000001230000-0x00000000012EE000-memory.dmp

        Filesize

        760KB

      • memory/3168-39-0x0000000000740000-0x0000000000741000-memory.dmp

        Filesize

        4KB

      • memory/4000-9-0x0000000000790000-0x00000000007B9000-memory.dmp

        Filesize

        164KB

      • memory/4000-23-0x0000000002730000-0x00000000029F9000-memory.dmp

        Filesize

        2.8MB

      • memory/4000-24-0x0000000000790000-0x00000000007B9000-memory.dmp

        Filesize

        164KB

      • memory/4000-22-0x0000000000B70000-0x0000000000C2E000-memory.dmp

        Filesize

        760KB

      • memory/4000-15-0x0000000000850000-0x0000000000851000-memory.dmp

        Filesize

        4KB

      • memory/4000-11-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/4836-44-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB