Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 09:38
Behavioral task
behavioral1
Sample
af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe
Resource
win7-20221111-en
5 signatures
150 seconds
General
-
Target
af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe
-
Size
1.5MB
-
MD5
7f7b975c1658fe0fc6d7913f1bdd08a7
-
SHA1
45ccf2ad1260883df7d14df36b47f47b32ffc480
-
SHA256
af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c
-
SHA512
7f1fa7a52b7d3821b1cdc1e3b7eda0744040018fa06a40ed2e99b9b2d83b28afabb7f111be8c1470c4cb408323d875e594b8f9346fd36486088c3567364d795b
-
SSDEEP
24576:tmpzgGd5UyylnSF99NfqLi+gJmssUZpwEi5nLwrFqznNM:IplDlmBvPp5nLwrFinNM
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
pid pid_target Process procid_target 1852 1740 WerFault.exe 18 -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeAssignPrimaryTokenPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeLockMemoryPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeIncreaseQuotaPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeMachineAccountPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeTcbPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeSecurityPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeTakeOwnershipPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeLoadDriverPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeSystemProfilePrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeSystemtimePrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeProfSingleProcessPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeIncBasePriorityPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeCreatePagefilePrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeCreatePermanentPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeBackupPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeRestorePrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeShutdownPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeDebugPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeAuditPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeSystemEnvironmentPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeChangeNotifyPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeRemoteShutdownPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeUndockPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeSyncAgentPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeEnableDelegationPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeManageVolumePrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeImpersonatePrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: SeCreateGlobalPrivilege 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: 31 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: 32 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: 33 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: 34 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe Token: 35 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1852 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe 29 PID 1740 wrote to memory of 1852 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe 29 PID 1740 wrote to memory of 1852 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe 29 PID 1740 wrote to memory of 1852 1740 af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe"C:\Users\Admin\AppData\Local\Temp\af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 6802⤵
- Program crash
PID:1852
-