Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30/09/2022, 18:59
General
-
Target
75010cf6fecedc8b56be91e66d2af087c3b1b451ad322e11d88f0fea37d48ba8.exe
-
Size
854KB
-
MD5
48638104772c22147645d4f541d242d2
-
SHA1
e4ee0f105196324f465026ad2187efb822b80b66
-
SHA256
75010cf6fecedc8b56be91e66d2af087c3b1b451ad322e11d88f0fea37d48ba8
-
SHA512
b020f6a376f6af34147090e7b81d9b3f4abf3b1de9f33767a28b97b16181911461b635df8c8c21fc77bc85e2d8e23eb1f6a250754a758f9c349872b021a2525d
-
SSDEEP
12288:8Vv1Bw9a04jj6UmaIxuxAm5FlB0ivLobXvxq3xWmAWx77a4DChCxrwPOTjm+2e:QE9yrmIAAA8oNmxWmAWxKvhCxwPOTjm
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\75010cf6fecedc8b56be91e66d2af087c3b1b451ad322e11d88f0fea37d48ba8.exe"C:\Users\Admin\AppData\Local\Temp\75010cf6fecedc8b56be91e66d2af087c3b1b451ad322e11d88f0fea37d48ba8.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory