Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2023, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
vdsc.exe
Resource
win7-20230220-en
4 signatures
150 seconds
General
-
Target
vdsc.exe
-
Size
309KB
-
MD5
2a3823f5002b14a203fd3f2d6b5b6e53
-
SHA1
b90e9e1e66014944e7b6f0062f943d57a4106a29
-
SHA256
fe382c12a7de4e87f184cf400f190ebd9e7e49d5ae7673bae9df5f76ff23149a
-
SHA512
3e22014fc37d1d1645cee0f924101ba00cfebf40c6d51e1aba456dccc8e81a3ab2414b8fb596f0c5134a282210703075fde96593d9d319ec5adf9370af418e99
-
SSDEEP
6144:I7TbPC4xhavVTLvDVpH8Jbi9WqJFFK3ojNmTHWzW:I7TTlmTXVpH6CWqJTV4THWz
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 920 set thread context of 1240 920 vdsc.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1240 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1240 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28 PID 920 wrote to memory of 1240 920 vdsc.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\vdsc.exe"C:\Users\Admin\AppData\Local\Temp\vdsc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-