Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION _RFQ# 1043999.exe
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
QUOTATION _RFQ# 1043999.exe
Resource
win10v2004-20230220-en
11 signatures
150 seconds
General
-
Target
QUOTATION _RFQ# 1043999.exe
-
Size
1.1MB
-
MD5
e434e422d6bb9bc02f9a4be0b1c41d1b
-
SHA1
af7347b789fb43b26a83f4864e50eedf7f62095e
-
SHA256
c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd
-
SHA512
72ffed26dfa5617a70852e88d8058d6adebcbd771bc3f0102f8fcf9bdddcac2264b37d07b5fd4790c177ad87f81fce0253ff9fc85c22f8034c066e66df657552
-
SSDEEP
24576:nVlj9vY9URDvRtWBQDtty/ziBgqMSAqzQYkYJrrzZL:nVB9g9YDptWuryduIA1L
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe 1320 QUOTATION _RFQ# 1043999.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1320 QUOTATION _RFQ# 1043999.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1320 wrote to memory of 908 1320 QUOTATION _RFQ# 1043999.exe 28 PID 1320 wrote to memory of 908 1320 QUOTATION _RFQ# 1043999.exe 28 PID 1320 wrote to memory of 908 1320 QUOTATION _RFQ# 1043999.exe 28 PID 1320 wrote to memory of 908 1320 QUOTATION _RFQ# 1043999.exe 28 PID 1320 wrote to memory of 1500 1320 QUOTATION _RFQ# 1043999.exe 29 PID 1320 wrote to memory of 1500 1320 QUOTATION _RFQ# 1043999.exe 29 PID 1320 wrote to memory of 1500 1320 QUOTATION _RFQ# 1043999.exe 29 PID 1320 wrote to memory of 1500 1320 QUOTATION _RFQ# 1043999.exe 29 PID 1320 wrote to memory of 1652 1320 QUOTATION _RFQ# 1043999.exe 30 PID 1320 wrote to memory of 1652 1320 QUOTATION _RFQ# 1043999.exe 30 PID 1320 wrote to memory of 1652 1320 QUOTATION _RFQ# 1043999.exe 30 PID 1320 wrote to memory of 1652 1320 QUOTATION _RFQ# 1043999.exe 30 PID 1320 wrote to memory of 600 1320 QUOTATION _RFQ# 1043999.exe 31 PID 1320 wrote to memory of 600 1320 QUOTATION _RFQ# 1043999.exe 31 PID 1320 wrote to memory of 600 1320 QUOTATION _RFQ# 1043999.exe 31 PID 1320 wrote to memory of 600 1320 QUOTATION _RFQ# 1043999.exe 31 PID 1320 wrote to memory of 320 1320 QUOTATION _RFQ# 1043999.exe 32 PID 1320 wrote to memory of 320 1320 QUOTATION _RFQ# 1043999.exe 32 PID 1320 wrote to memory of 320 1320 QUOTATION _RFQ# 1043999.exe 32 PID 1320 wrote to memory of 320 1320 QUOTATION _RFQ# 1043999.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"2⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"2⤵PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"2⤵PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"2⤵PID:600
-
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"2⤵PID:320
-