Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    500s
  • max time network
    433s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2022, 16:12 UTC

General

  • Target

    builder.exe

  • Size

    469KB

  • MD5

    c2bc344f6dde0573ea9acdfb6698bf4c

  • SHA1

    d6ae7dc2462c8c35c4a074b0a62f07cfef873c77

  • SHA256

    a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db

  • SHA512

    d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0

  • SSDEEP

    12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\builder.exe
    "C:\Users\Admin\AppData\Local\Temp\builder.exe"
    1⤵
      PID:1132
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1700
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x5a4
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1040

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1132-54-0x0000000075931000-0x0000000075933000-memory.dmp

        Filesize

        8KB

      • memory/1700-55-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

        Filesize

        8KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.