Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

file.exe

windows7_x64

1

file.exe

windows10-2004_x64

4

Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    20/02/2022, 16:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    2.6MB

  • MD5

    d7a7fd3a7e3501114fd0049457f5ce09

  • SHA1

    3e794a584d75c2ceb07287fe450dcdc4d7ce949a

  • SHA256

    b588823eb5c65f36d067d496881d9c704d3ba57100c273656a56a43215f35442

  • SHA512

    404c7ac446b4f08253fed5e563b8a7921afd09076d185d0eddd357cb9547da3bb1492e539197948c493390f169db7fcef42be488ab782272f020a476f55b2b73

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
      PID:3092
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:788

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/788-132-0x000001AC07D30000-0x000001AC07D40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/788-133-0x000001AC07D90000-0x000001AC07DA0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/788-134-0x000001AC0AA90000-0x000001AC0AA94000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3092-130-0x0000000000697000-0x000000000072A000-memory.dmp

      Filesize

      588KB

      Download

    • memory/3092-131-0x0000000000401000-0x000000000040D000-memory.dmp

      Filesize

      48KB

      Download