Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
137s -
platform
windows7_x64 -
resource
win7 -
submitted
09/07/2020, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipping Documents.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Shipping Documents.exe
-
Size
590KB
-
MD5
e87f847dd6aea20684b67ab3eab8e992
-
SHA1
24531e53a0cffd0d4772bebebad7eb5a5071dfec
-
SHA256
e734cfb1c78da531edac0e5772b8892c4995862bffb6e8f5eb4bbc7a2090c174
-
SHA512
c222f478e1028cf7591f9f612dcb449e8b1e5278a608c665388a4338105afabab4d253f5738c4db678ed1a1770258083dd15560a135b2560e3860e242c05c057
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1508 1164 Shipping Documents.exe 24 PID 1164 wrote to memory of 1508 1164 Shipping Documents.exe 24 PID 1164 wrote to memory of 1508 1164 Shipping Documents.exe 24 PID 1164 wrote to memory of 1508 1164 Shipping Documents.exe 24 PID 1164 wrote to memory of 1580 1164 Shipping Documents.exe 25 PID 1164 wrote to memory of 1580 1164 Shipping Documents.exe 25 PID 1164 wrote to memory of 1580 1164 Shipping Documents.exe 25 PID 1164 wrote to memory of 1580 1164 Shipping Documents.exe 25 PID 1164 wrote to memory of 284 1164 Shipping Documents.exe 26 PID 1164 wrote to memory of 284 1164 Shipping Documents.exe 26 PID 1164 wrote to memory of 284 1164 Shipping Documents.exe 26 PID 1164 wrote to memory of 284 1164 Shipping Documents.exe 26 PID 1164 wrote to memory of 272 1164 Shipping Documents.exe 27 PID 1164 wrote to memory of 272 1164 Shipping Documents.exe 27 PID 1164 wrote to memory of 272 1164 Shipping Documents.exe 27 PID 1164 wrote to memory of 272 1164 Shipping Documents.exe 27 PID 1164 wrote to memory of 1632 1164 Shipping Documents.exe 28 PID 1164 wrote to memory of 1632 1164 Shipping Documents.exe 28 PID 1164 wrote to memory of 1632 1164 Shipping Documents.exe 28 PID 1164 wrote to memory of 1632 1164 Shipping Documents.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1164 Shipping Documents.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1164 Shipping Documents.exe 1164 Shipping Documents.exe 1164 Shipping Documents.exe 1164 Shipping Documents.exe 1164 Shipping Documents.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"{path}"2⤵PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"{path}"2⤵PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"{path}"2⤵PID:284
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"{path}"2⤵PID:272
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"{path}"2⤵PID:1632
-