Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe
-
Size
210KB
-
MD5
a9e77045cee25859b1de4aebcfae17e2
-
SHA1
c072142187f071cae6657b4c346c2bffded45284
-
SHA256
ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da
-
SHA512
e18f0d017cb18e7161dcf8abe0e361bf19fbc8618261c95e19b01baf3b0274d6c07d1b0267d86adb619ebfbeb35c2ae544d966ca603bbe252fea4eb909e276d9
-
SSDEEP
3072:JBnTtlU8BJjLk/JgRIn9AsUfbCwW8sest6oY8nwVLmVDG4YJqC7eTpsv:JT2WJ+JgO9/UfuxvFYVVMDXqqCiGv
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 10664725708588318870 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4278190080 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 1207959552 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 3472883712 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 1 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 8589934591 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 8589934591 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4294972880 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 652835041420 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 171798704864 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 3427383903248 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 16131897164070 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 20255065768258 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 85899346028 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 15564961480708 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 747324309876 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4294967297 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 12884901889 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 51539607780 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 51539607716 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 8589934591 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 8589934591 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 8589934591 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 0 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 8589934591 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 10664725708588318870 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4278190080 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 1207959552 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 3472883712 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 1 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 2130511440 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 4096 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe Token: 72090240084344833 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1440 wrote to memory of 1296 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe 10 PID 1440 wrote to memory of 1296 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe 10 PID 1440 wrote to memory of 1296 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe 10 PID 1440 wrote to memory of 1296 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe 10 PID 1440 wrote to memory of 1296 1440 ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe"C:\Users\Admin\AppData\Local\Temp\ea29fcced5953e068b7dd4be1348255a4d751aafd69cc9efdb89de0ab7f8d9da.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1440
-