Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03/03/2023, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
b329525d2d62f10d7a8fdb25bb9d9a43.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b329525d2d62f10d7a8fdb25bb9d9a43.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
b329525d2d62f10d7a8fdb25bb9d9a43.exe
-
Size
1.7MB
-
MD5
b329525d2d62f10d7a8fdb25bb9d9a43
-
SHA1
43190e85312bd69cda8c094a0085ea188832bbbc
-
SHA256
e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7
-
SHA512
053f1ff542bf1ac0bbbfc4f320c62cc5b63092f7ff0b882c0d7d8bf7b3a3609c42b817d2d527f9f8841035d5883eea91676b93fbc60779d68d119ee1e1460ad1
-
SSDEEP
6144:8GeEeHycW2dJDPEu0asM763jnJioXhbDJOTulPkkKeYBtEloF:
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 980 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 27 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 868 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 28 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1108 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 29 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 1492 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 30 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31 PID 1240 wrote to memory of 524 1240 b329525d2d62f10d7a8fdb25bb9d9a43.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b329525d2d62f10d7a8fdb25bb9d9a43.exe"C:\Users\Admin\AppData\Local\Temp\b329525d2d62f10d7a8fdb25bb9d9a43.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:868
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1108
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:524
-