Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe
Resource
win7-20221111-en
3 signatures
150 seconds
General
-
Target
3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe
-
Size
150KB
-
MD5
6d54f69bf2506d1cda915f42fe036a78
-
SHA1
5ff964916ea4d0702101eee4b1174e01255e53ab
-
SHA256
3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208
-
SHA512
62b015a2521687cdc073ac867e0327205630aa525d3fd2baf66ce4d2b59ca8f5e6816b87766a39586d06d9950b36fcbb9d22fd461eea52bf9d4c61fd5032a47d
-
SSDEEP
1536:a18Lc+Oba8LfMTVjXGqrtB5qXbP3eJG53G73mxdvdUCmRPLeA1Nb7Y6h:CR+Oba8wXr5qXbP32GhNv1mVLeAXY6h
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2060 netsh.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: 33 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe Token: SeIncBasePriorityPrivilege 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4264 wrote to memory of 2060 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe 89 PID 4264 wrote to memory of 2060 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe 89 PID 4264 wrote to memory of 2060 4264 3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe"C:\Users\Admin\AppData\Local\Temp\3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe" "3103fa46fe3c05eda8d67246da279dd1c7cc2519789bef5a66ba852758312208.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:2060
-