Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 18:00
Static task
static1
Behavioral task
behavioral1
Sample
96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe
Resource
win10v2004-20220812-en
General
-
Target
96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe
-
Size
48KB
-
MD5
36ab8582c815d4a36056e5097de105e7
-
SHA1
7373be2838c6fe129ad93c3f20976c7767fa5715
-
SHA256
96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775
-
SHA512
5767835bb50bb17a0a2b1f78f5997d36c2adc55872972ecaf1c40cc739df084cc5f1434fdd4337183629b921eec831064a11c38617ad60c23415f7162cd7941e
-
SSDEEP
768:fOFT4hx6/jEQgkTwQVWyK4SFJG7z9b1mIdoCFMA6cRVPAHkfShlw4D33vNE:fDxO+kTwQVCGf9bsd/Q8Hdvw4T+
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\$NtUninstallKB56439$\759135181 96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe File opened for modification C:\Windows\$NtUninstallKB56439$\:SummaryInformation 96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Windows\$NtUninstallKB56439$\:SummaryInformation 96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2568 96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe 2568 96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2568 96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe"C:\Users\Admin\AppData\Local\Temp\96b77c74776ce80dde1bfabdbb67723ccf770efca58e7c6acddaa67ca11e6775.exe"1⤵
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568