Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/12/2022, 19:37
221228-yb6lwabd55 828/12/2022, 19:35
221228-yandxaed9z 128/12/2022, 19:22
221228-x3lkcaed8x 4Analysis
-
max time kernel
117s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/12/2022, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
Minecraft.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
Minecraft.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
300 seconds
General
-
Target
Minecraft.exe
-
Size
397KB
-
MD5
d99bb55b57712065bc88be297c1da38c
-
SHA1
fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
-
SHA256
122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
-
SHA512
3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
-
SSDEEP
3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 948 vlc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1772 taskmgr.exe 948 vlc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1772 taskmgr.exe Token: 33 884 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 884 AUDIODG.EXE Token: 33 884 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 884 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe -
Suspicious use of SendNotifyMessage 52 IoCs
pid Process 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 1772 taskmgr.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe 948 vlc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1708 javaw.exe 1708 javaw.exe 1708 javaw.exe 1708 javaw.exe 948 vlc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 824 wrote to memory of 1708 824 Minecraft.exe 28 PID 824 wrote to memory of 1708 824 Minecraft.exe 28 PID 824 wrote to memory of 1708 824 Minecraft.exe 28 PID 824 wrote to memory of 1708 824 Minecraft.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1772
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x55c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:884
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RevokeSend.mpg"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:948