Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/05/2023, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
obabma.jpg
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
obabma.jpg
Resource
win10v2004-20230220-en
12 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
obabma.jpg
-
Size
191KB
-
MD5
992fc3e7a36d29ba14254c3f05d2e649
-
SHA1
a80c4610659b747aee95ee6c4c22d28b768710d7
-
SHA256
4f11e355a779546dfc53e15abb176a51b44e408d9f097dd6a90c0e2122fcf3bf
-
SHA512
6d83a3d0454789ff9e6c5711ab2a8b5a41fb7acf29a2bd70f6e65a6700d6a69a9bda79166e855259aad863b0a2aeadad7dabb5d975f03fa3916ce031d93cd842
-
SSDEEP
3072:mQ0oK8mIc5T/sXOcg6e+EmDFYl0/JqEBHRpUdMrXCK0K6wTWKNDEUXUFeJokBMn3:mPohc5T0XORIYm/JdxSb3wT1EYUFCXq3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 764 LogonUI.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 rundll32.exe
Processes
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\obabma.jpg1⤵
- Suspicious use of FindShellTrayWindow
PID:2040
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
- Suspicious use of AdjustPrivilegeToken
PID:764