Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2024, 06:14

General

  • Target

    55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe

  • Size

    368KB

  • MD5

    aca331cef26e80df50aad16106791cf0

  • SHA1

    3eb52a5eee4c386e23c31521a886093d0850a020

  • SHA256

    55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280dd

  • SHA512

    9eb23a32eb2641cd5d4be9a4704011f37d878d73a0443296f4e62c8db85a6bb770b4bef8b32863a88e1c641108aa05cfb46130fc957933cdea7d2d03f3ec70cc

  • SSDEEP

    6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qF:emSuOcHmnYhrDMTrban4qF

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Trickbot x86 loader 5 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe
    "C:\Users\Admin\AppData\Local\Temp\55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280ddN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe
      C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5100
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:3228
    • C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe
      C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:232

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\0f5007522459c86e95ffcc62f32308f1_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7

        Filesize

        1KB

        MD5

        bcc75f6155be383567e3adebc054f7db

        SHA1

        59c9f03d42a83544cd933921bdb129ed82cf28f1

        SHA256

        a49d4a7da0be0ef444aa23a7f6073897d2a4ae7d1c8280052cee7bc89fac6ab7

        SHA512

        65fa4347fa4540d70142b9c3f92dca88f8bfcf9d2ba081a773116d8327ee0cd36019b29931dc0e5e4654c845bf6ee7f8bf4c5d95d10f32663549f1fde3f3266a

      • C:\Users\Admin\AppData\Roaming\WNetval\66e712ab8f9197719deb3900bd209888d09f2b80be914b1d241acef1dc7290ddN.exe

        Filesize

        368KB

        MD5

        aca331cef26e80df50aad16106791cf0

        SHA1

        3eb52a5eee4c386e23c31521a886093d0850a020

        SHA256

        55e612ab7f9196618deb3800bd208777d09f2b70be814b1d241acef1dc6280dd

        SHA512

        9eb23a32eb2641cd5d4be9a4704011f37d878d73a0443296f4e62c8db85a6bb770b4bef8b32863a88e1c641108aa05cfb46130fc957933cdea7d2d03f3ec70cc

      • memory/232-43-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/404-6-0x0000000001200000-0x0000000001229000-memory.dmp

        Filesize

        164KB

      • memory/404-1-0x0000000001200000-0x0000000001229000-memory.dmp

        Filesize

        164KB

      • memory/1808-33-0x00000000010B0000-0x00000000010B1000-memory.dmp

        Filesize

        4KB

      • memory/1808-41-0x0000000001010000-0x0000000001039000-memory.dmp

        Filesize

        164KB

      • memory/1808-40-0x0000000001970000-0x0000000001C39000-memory.dmp

        Filesize

        2.8MB

      • memory/1808-39-0x00000000018B0000-0x000000000196E000-memory.dmp

        Filesize

        760KB

      • memory/3228-16-0x0000014D86CF0000-0x0000014D86CF1000-memory.dmp

        Filesize

        4KB

      • memory/3228-19-0x0000000010000000-0x000000001001F000-memory.dmp

        Filesize

        124KB

      • memory/5100-9-0x0000000000F80000-0x0000000000FA9000-memory.dmp

        Filesize

        164KB

      • memory/5100-23-0x0000000002D90000-0x0000000003059000-memory.dmp

        Filesize

        2.8MB

      • memory/5100-24-0x0000000000F80000-0x0000000000FA9000-memory.dmp

        Filesize

        164KB

      • memory/5100-22-0x0000000002CD0000-0x0000000002D8E000-memory.dmp

        Filesize

        760KB

      • memory/5100-15-0x0000000001150000-0x0000000001151000-memory.dmp

        Filesize

        4KB

      • memory/5100-11-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/5100-10-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB