Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2024, 02:50

General

  • Target

    0069a24aff897f57fbc861fbcf5fca0fac7297da883ac169b09b1259d5ba2dbb.exe

  • Size

    368KB

  • MD5

    46b6312d182ac953c201c1b6bf1bacf6

  • SHA1

    6edcdb9d801e1ef4d6f096360f872d58b3bfb339

  • SHA256

    0069a24aff897f57fbc861fbcf5fca0fac7297da883ac169b09b1259d5ba2dbb

  • SHA512

    f6240ca84c7632f00ffbe4de08ece155d238f4a9ef7fa7cdec1699afba18fe937c756072504243bdd5a66450a2f789cbb2082d0cd6f461cf555fdae4a671aa3a

  • SSDEEP

    6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qf:emSuOcHmnYhrDMTrban4qf

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Trickbot x86 loader 6 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0069a24aff897f57fbc861fbcf5fca0fac7297da883ac169b09b1259d5ba2dbb.exe
    "C:\Users\Admin\AppData\Local\Temp\0069a24aff897f57fbc861fbcf5fca0fac7297da883ac169b09b1259d5ba2dbb.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Users\Admin\AppData\Roaming\WNetval\0079a24aff998f68fbc971fbcf6fca0fac8298da993ac179b09b1269d6ba2dbb.exe
      C:\Users\Admin\AppData\Roaming\WNetval\0079a24aff998f68fbc971fbcf6fca0fac8298da993ac179b09b1269d6ba2dbb.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:412
    • C:\Users\Admin\AppData\Roaming\WNetval\0079a24aff998f68fbc971fbcf6fca0fac8298da993ac179b09b1269d6ba2dbb.exe
      C:\Users\Admin\AppData\Roaming\WNetval\0079a24aff998f68fbc971fbcf6fca0fac8298da993ac179b09b1269d6ba2dbb.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:2004

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940901362-3608833189-1915618603-1000\0f5007522459c86e95ffcc62f32308f1_f2cdb6fb-4ab8-4547-9f25-fad1f7a44351

        Filesize

        1KB

        MD5

        5894a0af97f3f88f5d233564f91845ed

        SHA1

        2ca2c83a50f4c5ad1d16c27d269a49b951c85d94

        SHA256

        a6196fe64ae5b4e96cc8bcb702f64ec2c3944e165b79d7417e807ef9bc4aadfc

        SHA512

        8c5c05d7daafea8f0b278dbca57436321d30910312df5d89d776f8fa3d88262bcebb7d3666cc79ea97c3744cca8a163c3b7626fb44a3e8b2129cf271f89cbfa2

      • C:\Users\Admin\AppData\Roaming\WNetval\0079a24aff998f68fbc971fbcf6fca0fac8298da993ac179b09b1269d6ba2dbb.exe

        Filesize

        368KB

        MD5

        46b6312d182ac953c201c1b6bf1bacf6

        SHA1

        6edcdb9d801e1ef4d6f096360f872d58b3bfb339

        SHA256

        0069a24aff897f57fbc861fbcf5fca0fac7297da883ac169b09b1259d5ba2dbb

        SHA512

        f6240ca84c7632f00ffbe4de08ece155d238f4a9ef7fa7cdec1699afba18fe937c756072504243bdd5a66450a2f789cbb2082d0cd6f461cf555fdae4a671aa3a

      • memory/412-17-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/412-21-0x000002DB13B00000-0x000002DB13B01000-memory.dmp

        Filesize

        4KB

      • memory/412-16-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/1352-42-0x0000000000DF0000-0x0000000000E19000-memory.dmp

        Filesize

        164KB

      • memory/1352-28-0x0000000000DF0000-0x0000000000E19000-memory.dmp

        Filesize

        164KB

      • memory/1352-41-0x0000000001840000-0x0000000001B09000-memory.dmp

        Filesize

        2.8MB

      • memory/1352-40-0x0000000001780000-0x000000000183E000-memory.dmp

        Filesize

        760KB

      • memory/1352-34-0x0000000000E90000-0x0000000000E91000-memory.dmp

        Filesize

        4KB

      • memory/2004-44-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/3652-1-0x0000000000E40000-0x0000000000E69000-memory.dmp

        Filesize

        164KB

      • memory/3652-7-0x0000000000E40000-0x0000000000E69000-memory.dmp

        Filesize

        164KB

      • memory/4080-9-0x00000000012A0000-0x00000000012C9000-memory.dmp

        Filesize

        164KB

      • memory/4080-23-0x0000000003180000-0x0000000003449000-memory.dmp

        Filesize

        2.8MB

      • memory/4080-24-0x00000000012A0000-0x00000000012C9000-memory.dmp

        Filesize

        164KB

      • memory/4080-22-0x00000000030C0000-0x000000000317E000-memory.dmp

        Filesize

        760KB

      • memory/4080-15-0x0000000001560000-0x0000000001561000-memory.dmp

        Filesize

        4KB

      • memory/4080-10-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB