Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe
Resource
win10v2004-20220901-en
Errors
General
-
Target
c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe
-
Size
92KB
-
MD5
92828dfaf65134e7da61d874873d76e6
-
SHA1
3a9f929a90332b04e94c4a03602e5c4d6a9991a5
-
SHA256
c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca
-
SHA512
94a6a48ca5ae899c788c4cd8e7940201ae57716ff97fa102d75f2a3e3a3c2d547922421ba59185aff58632b7e5e2af5425b371de93b2c24114a4eefbcff5c190
-
SSDEEP
1536:ZhW/sAT6y1i5LIo/vL6Ya39u57n6GxcfAf4AlqeTCQ1ioSJlIU:/WH10LjLq9uF6uIEqe/ioSJlIU
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ciybrgl.dll c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1416 c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe"C:\Users\Admin\AppData\Local\Temp\c516cdfce5ed75b458006e3d95fd4b04c2fe00e6f4bbaebf2aa2d1fcabfd4fca.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:268