Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
29/06/2023, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
Uploader.zip
Resource
win7-20230621-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Uploader.zip
Resource
win10v2004-20230621-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup_x32_x64.exe
Resource
win7-20230621-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Uploader.zip
-
Size
441KB
-
MD5
8ab1a5c8f423bb9b62e68445e542fbcc
-
SHA1
c0fe62d65887d65af8af9f7acbdf7b0e9ebb7458
-
SHA256
4545c839b596f8d01becff14bb61ab84ee25af14e6ba63a946d0ff58eb0f8275
-
SHA512
1ecea21b9fac21e6f34f4ae745d1c8888fe6a8830379d18f7d9472606ae5421e44dbd0da0ade0c9732a273a73b5b86cb85923021e5d6c9ea45320dec8b190129
-
SSDEEP
12288:XNb5SxTKA36CcwdkTIWrR1eXk51r9o4vZDh6p02p:9OTK4rcqkTBr2CbDw02p
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1168 taskmgr.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Uploader.zip1⤵PID:1724
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1168