Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/09/2022, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
Resource
win10v2004-20220812-en
General
-
Target
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
-
Size
828KB
-
MD5
f959caab239f677486946f7f09184c85
-
SHA1
ea80e8a5e9ffd652cfcc89fae7a4c758220769a7
-
SHA256
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68
-
SHA512
dd26c9e47c2906f69fbb2784f7e284457212b1eb7a591f23f01abfd06cd9ff897c47477c98ec220c05e3e81c1ca082be4f64d1eab6866d97da99372ed194de76
-
SSDEEP
12288:a6HNnpNtD5T39IOCFWXr3f9RXrn2Ve0ikyW5a5VLW4ZNX/LJCl5RXPi2VDRq5u8S:9NVDJ93CFWXrP9REedRWc9vLs
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1184 f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe 1184 f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1184 f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe"C:\Users\Admin\AppData\Local\Temp\f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184