Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe
Resource
win10v2004-20221111-en
General
-
Target
e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe
-
Size
5KB
-
MD5
484c51c542c2d375ac70688ae5284450
-
SHA1
80d946a31ca0104903f6b28330b17d7610281ba8
-
SHA256
e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30
-
SHA512
16cfeebee3d1fa4e70951dc54b1e664d27bdce3d21c060197ca73b3d43dce1127ba210ff7a8e7751717ca57cfbeeb7e35ca84cb1f777f35e50e6e08bb00159e9
-
SSDEEP
96:p1ppTn7ZTRrYKjGmbhNGb1U8muT4fsn7g/ujq5b4XPJ/2TBBhRw34W:bNRrllNGZ9T4fssmuR4Be1B3w34W
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\secure32.html e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe File opened for modification \??\c:\Program Files\niiivl.exe e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1280 e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe"C:\Users\Admin\AppData\Local\Temp\e77d1667e09bd91869475315c1dba3e7ee3e1da3272a8e4475bf4147045a0b30.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280