Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
10s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
14/02/2023, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
Salwyrr Launcher Installer.exe
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Salwyrr Launcher Installer.exe
Resource
win10v2004-20220812-en
3 signatures
150 seconds
General
-
Target
Salwyrr Launcher Installer.exe
-
Size
46KB
-
MD5
38633bfef3c1fe505a39a688b5c31828
-
SHA1
4e053e5ca9e8bfcf372b4331b18c36d637332bbc
-
SHA256
413a460fae724b972ab9c52aeab029552245555c7df5b79eb2a6529e1dd7a090
-
SHA512
812ebfa26ff63ade8ab4851230fe47c0ffb797b5a8c48d6ab7ad3293a4995c088bedb8ca7ad6c48a63b3c7f60cdf5b2b318b39dc232ef2096721aba7734ea8f7
-
SSDEEP
768:PE55gC6d1VepljbMBMxECL67qtjMGF9TtgmAtugTtyKr:svh6dTepljLEf44u4mMuAyKr
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1724 netsh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 952 Salwyrr Launcher Installer.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28 PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28 PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28 PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28 PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28 PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28 PID 952 wrote to memory of 1724 952 Salwyrr Launcher Installer.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 1a"2⤵
- Modifies Windows Firewall
PID:1724
-