Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/06/2023, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe
Resource
win10v2004-20230220-en
General
-
Target
cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe
-
Size
2.7MB
-
MD5
8ef203be40c1910f118cfc8e66f91e93
-
SHA1
11f8c35a0bc2521f5677d137276b07b1cebfbb18
-
SHA256
cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda
-
SHA512
a73ae8b23ebff6cfc7ff4cb15be659b7363a18cb61d862e95f5f9c57a9dbee150b607de072a7e9d91d5a31b5d102ca60b0d1d760aa08b8ef009d74fa9f0e2590
-
SSDEEP
49152:ix15RFlEH+RiUBC8RtdujoMKNhbBkujDlZBk8yi3jeFB:uHFlEH+IUBC8RvujoMKNZ+ujDlZBtymU
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1076 cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1076 cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe 1076 cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe"C:\Users\Admin\AppData\Local\Temp\cb4da0647e92e3b484fa275b257516b948b679ca57395214f2ff892dc5f59dda.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076