Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe
-
Size
422KB
-
MD5
839d8d19bb9030afe8c8db9f621eaf20
-
SHA1
b984f9a2a577d215629fdf2f0e5bd27fee51e7f9
-
SHA256
3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa
-
SHA512
5e299c5860fe756609f6cf2135f4c49a01171b83a1695e95a515d5ba7a4a312ebe7479129dfea17139beeeaffc641ad6f5dc6891338c295ed76210dbc154080c
-
SSDEEP
6144:tmwa1PEq/Dz4AbgAlrUWpWcgQZNddAwXajgFEn8Awpdm73KPCOK6Zni:tm31PlMaJrDPgEddtygcDWCP6Zni
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1884-56-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1884-57-0x0000000000400000-0x00000000004D2000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1884 3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe