Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

bfefb29a67...28.exe

windows7-x64

bfefb29a67...28.exe

windows10-2004-x64

Analysis

  • max time kernel
    49s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:37

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    bfefb29a673c1e391444f18aed7921bce50a2dffb8fd0bf0a599b323d8b3df28.exe

  • Size

    26KB

  • MD5

    e63a78b63f158f0b66a0489425ed6658

  • SHA1

    eacdcb66a8aaf187e3a7df0a561784e8330680d8

  • SHA256

    bfefb29a673c1e391444f18aed7921bce50a2dffb8fd0bf0a599b323d8b3df28

  • SHA512

    f147b038d66b47a8a8b566388518d384cbbd442544a123f24e80f8528aa7b3e17da5f842cad342609d2aefa26ca5b3a5bd57fb0bdd8cca173c12cea301e6ce62

  • SSDEEP

    384:X0OMyMcQ6NnThvxpi6W62aIuy67m11XgcS/QH7vZv0VeZko/Ptbw/Q:Er6teU2xY/uhZkOP1

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfefb29a673c1e391444f18aed7921bce50a2dffb8fd0bf0a599b323d8b3df28.exe
    "C:\Users\Admin\AppData\Local\Temp\bfefb29a673c1e391444f18aed7921bce50a2dffb8fd0bf0a599b323d8b3df28.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1936
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1736
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:1160

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1736-56-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1936-54-0x0000000075241000-0x0000000075243000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1936-55-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download