Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13/06/2023, 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pico_park.exe
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
pico_park.exe
Resource
win10v2004-20230220-en
0 signatures
150 seconds
General
-
Target
pico_park.exe
-
Size
11.5MB
-
MD5
52510d499d806b7dc392a17b12bc1ae5
-
SHA1
76688bea58b8bbe273956183bd7b03af116b7048
-
SHA256
9ffe2b62ed45181318a49a221eb497f5b55267fb512ce221408990ee6dce3354
-
SHA512
f2e70125085ba08d9c3c3a91a2ad6147b76947b3fa868babbf8468b6ea4d7c6e17d1a545ca561888f1d162e0c9d4348611013b10e89899e744067efbe7a05b4a
-
SSDEEP
98304:vkZFrZJWHX4IZCAzxcEz9b7F3kT+c2+KyDS2+KERA1Da7yH3XfEFEBvUIBig6rnO:2JW3BxcEzHo87yHWEB82R67jVWjG6f1
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1936 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1936 AUDIODG.EXE Token: 33 1936 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1936 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\pico_park.exe"C:\Users\Admin\AppData\Local\Temp\pico_park.exe"1⤵PID:1740
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1700
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2701⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936