Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    7s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2022, 10:31

General

  • Target

    f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe

  • Size

    828KB

  • MD5

    f959caab239f677486946f7f09184c85

  • SHA1

    ea80e8a5e9ffd652cfcc89fae7a4c758220769a7

  • SHA256

    f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68

  • SHA512

    dd26c9e47c2906f69fbb2784f7e284457212b1eb7a591f23f01abfd06cd9ff897c47477c98ec220c05e3e81c1ca082be4f64d1eab6866d97da99372ed194de76

  • SSDEEP

    12288:a6HNnpNtD5T39IOCFWXr3f9RXrn2Ve0ikyW5a5VLW4ZNX/LJCl5RXPi2VDRq5u8S:9NVDJ93CFWXrP9REedRWc9vLs

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
    "C:\Users\Admin\AppData\Local\Temp\f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1184-54-0x0000000010D70000-0x0000000010E44000-memory.dmp

    Filesize

    848KB

  • memory/1184-55-0x0000000004140000-0x00000000041D6000-memory.dmp

    Filesize

    600KB

  • memory/1184-56-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

    Filesize

    8KB