Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
241s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2023, 20:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DHLExpressShipmentDocuments.exe
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
DHLExpressShipmentDocuments.exe
Resource
win10v2004-20230220-en
10 signatures
150 seconds
General
-
Target
DHLExpressShipmentDocuments.exe
-
Size
510KB
-
MD5
04c4e5f6780a3cb02d7552c4eef6afdc
-
SHA1
e1a14a0ea53bee97a881f4e1be345e6a88c16a4b
-
SHA256
1a9ae4ba38387ca32e34d86e30811e1cb336ee23400936268f52cf570e623747
-
SHA512
0e2599f51398335050c05a14c47aceaacea9da0d40c13ef5baa6d253944ed822cb43efb32d5ba92e92dba8aed9dc8ca0d5416706e12f8f6513a6b290d6eb428b
-
SSDEEP
6144:0445VQTOGtzUFVII1k1u3QSjueihMnOjqk0h5jgzx+x9xa0ntAz/C:IiFV6ICk1u3b5ihcOu/4w9xB
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1496 DHLExpressShipmentDocuments.exe 1496 DHLExpressShipmentDocuments.exe 1496 DHLExpressShipmentDocuments.exe 1496 DHLExpressShipmentDocuments.exe 1496 DHLExpressShipmentDocuments.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1496 DHLExpressShipmentDocuments.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1524 1496 DHLExpressShipmentDocuments.exe 28 PID 1496 wrote to memory of 1524 1496 DHLExpressShipmentDocuments.exe 28 PID 1496 wrote to memory of 1524 1496 DHLExpressShipmentDocuments.exe 28 PID 1496 wrote to memory of 1524 1496 DHLExpressShipmentDocuments.exe 28 PID 1496 wrote to memory of 540 1496 DHLExpressShipmentDocuments.exe 29 PID 1496 wrote to memory of 540 1496 DHLExpressShipmentDocuments.exe 29 PID 1496 wrote to memory of 540 1496 DHLExpressShipmentDocuments.exe 29 PID 1496 wrote to memory of 540 1496 DHLExpressShipmentDocuments.exe 29 PID 1496 wrote to memory of 560 1496 DHLExpressShipmentDocuments.exe 30 PID 1496 wrote to memory of 560 1496 DHLExpressShipmentDocuments.exe 30 PID 1496 wrote to memory of 560 1496 DHLExpressShipmentDocuments.exe 30 PID 1496 wrote to memory of 560 1496 DHLExpressShipmentDocuments.exe 30 PID 1496 wrote to memory of 1320 1496 DHLExpressShipmentDocuments.exe 31 PID 1496 wrote to memory of 1320 1496 DHLExpressShipmentDocuments.exe 31 PID 1496 wrote to memory of 1320 1496 DHLExpressShipmentDocuments.exe 31 PID 1496 wrote to memory of 1320 1496 DHLExpressShipmentDocuments.exe 31 PID 1496 wrote to memory of 1104 1496 DHLExpressShipmentDocuments.exe 32 PID 1496 wrote to memory of 1104 1496 DHLExpressShipmentDocuments.exe 32 PID 1496 wrote to memory of 1104 1496 DHLExpressShipmentDocuments.exe 32 PID 1496 wrote to memory of 1104 1496 DHLExpressShipmentDocuments.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"2⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"2⤵PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"2⤵PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"2⤵PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"C:\Users\Admin\AppData\Local\Temp\DHLExpressShipmentDocuments.exe"2⤵PID:1104
-