Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
-
Size
32KB
-
MD5
35f10b14382748a5c02de35a811ee126
-
SHA1
376ba3cc7aadb61331b4209a4fac3bee611bc69e
-
SHA256
85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39
-
SHA512
c08ca9c750b686c2d745c983fd667f58f70c531214d7973ae3eb930ba5ec32b662d40e5a33eb03236cc7e3f2af13b2765030362e7d3e192f6cbe3ad7088feb48
-
SSDEEP
384:LxGOfCE0nZ6sFdVqaVzX1tZ6ku7AK4ZFv:NWhZ/dVpVzFVM
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\secure32.html 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe File opened for modification \??\c:\Program Files\nicr.exe 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\hosts 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2112 85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe"C:\Users\Admin\AppData\Local\Temp\85eaf162eec3728b8748cb4d7a102725efd29db15f8e3cf632b96c7263638c39.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112