Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
288s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20/09/2022, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe
Resource
win10-20220812-en
General
-
Target
789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe
-
Size
2.6MB
-
MD5
0c717a4d5c7c6a0716fa3d788f0b2cdd
-
SHA1
ccebe3bfbd0f46942c27e898b67dcd56c2dd7e27
-
SHA256
789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05
-
SHA512
314e1c5b4569f7ca2db449f4fe5d86dd56972ae59c08ce82618d889c2c311b5d744cb4d52fd7f89411afc30c7e185d8ef46274e2b205076b584bb74a9dd997af
-
SSDEEP
49152:DmVRGHUBcBLZ3K5va9tNCyK4Vs9mOpLbO88y8kiaAm3EmB5hwVjrrkxCP3RcdlsG:DmVRbO5Za5voN2aso4bOKiaB3Em1wht5
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 996 789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe"C:\Users\Admin\AppData\Local\Temp\789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:996