Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe
Resource
win10v2004-20221111-en
General
-
Target
53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe
-
Size
2.0MB
-
MD5
64ba3bab5e651ea7423ad3cdc2ffca4f
-
SHA1
6a33e0d6a2cefd283ce6104395202b661440df57
-
SHA256
53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb
-
SHA512
4b4e8168fe0caac58c3bf39f855fddf4ed8479880fdff4d063a3eacc0c81de760f4e5e7751b9b3ee705e6d54768454e014605fb540c49b1532a32a14cc7f6238
-
SSDEEP
49152:yNnYuf07xGV0mXvco1ZG/yk2PYeit8CaRDTLg:eYH4Vhv+6YeiJIDTLg
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1584 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1584 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1584 wrote to memory of 568 1584 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe 28 PID 1584 wrote to memory of 568 1584 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe 28 PID 1584 wrote to memory of 568 1584 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe 28 PID 1584 wrote to memory of 568 1584 53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe"C:\Users\Admin\AppData\Local\Temp\53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe"C:\Users\Admin\AppData\Local\Temp\53ab3b3381e74505c4b8d1c399684e48b78d41877cd227715a9c3479064b0cdb.exe"2⤵PID:568
-