Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe
-
Size
54KB
-
MD5
4d433e6a62a8750bd2396e5d417f9300
-
SHA1
40d964ebcc2031604ad9842edb4f642cb6f11e95
-
SHA256
200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15
-
SHA512
e821177d9b2b72990ba5e2880b89c60b5e0bd63a46b86cae72d3ccc9e8d0e82fc787d05cf86eb2c2430e7d324e6dcdff866a1f0582480f2b94cf77738a6cde5c
-
SSDEEP
768:MpnkR6TpGRFxkgtqQK22sVbrrk3zXaWj6JjpZnuM0mu4d8Nww:MnaEGygos6OWjw9ZJYOw
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 372 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 24 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 384 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 23 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 420 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 22 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 464 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 21 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 480 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 1 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 488 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 20 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 596 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 19 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 680 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 18 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 756 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 17 PID 900 wrote to memory of 824 900 200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe 2
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"2⤵PID:1188
-
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1876
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:1232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe"C:\Users\Admin\AppData\Local\Temp\200aa8415af0195c1c96a7b020b427fa51fc0925c1a9b377f0b2fd431a14bd15.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1104
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:852
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:596
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:488
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372