Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

Nowy folder (2).zip

windows7-x64

1

Nowy folder (2).zip

windows10-2004-x64

1

Analysis

  • max time kernel
    435s
  • max time network
    419s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2022, 13:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nowy folder (2).zip

  • Size

    159KB

  • MD5

    e69a6b4780eb0bbf3da5068e042f8080

  • SHA1

    05037d937ad7787642b4bbd25ac1e44a9edb7ece

  • SHA256

    b1ed0063b0dfbb769defcc2de51b59e1661791ec7eaa7232952bc63300085e9c

  • SHA512

    c7fd2dad13b365d00ebc896894eb478684602d3d01ca1ad9ca89194348838ae04af5b8b83fe41596b4dcb1400ffea781a1ee88e6de25cd56750c1bc44c7ef15f

  • SSDEEP

    3072:GHzUHBmJFKj2yzOxTYnKHue72lt1Ec68uft8Ib5hKBF5wsHvzmZR8t:GQh8KPK+KHueqtN69V8WIpvz4R8t

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Nowy folder (2).zip"
    1⤵
      PID:944
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:844
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x55c
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1200
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Nowy folder (2)\" -spe -an -ai#7zMap26841:88:7zEvent31052
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:968
      • C:\Windows\System32\rundll32.exe
        "C:\Windows\System32\rundll32.exe" \armeta.dat,init
        1⤵
          PID:868
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe"
          1⤵
            PID:1196

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/844-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

            Filesize

            8KB

            Download