Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
510s -
max time network
501s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
11/07/2023, 11:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Toad.exe
Resource
win7-20230703-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Toad.exe
-
Size
79KB
-
MD5
2bd82dba9928ac6facb75f05af7f33c9
-
SHA1
dc73c02c42d08af58b1105a7ceda8782cd73b5a8
-
SHA256
1f7aed5e0e0e15a7e2a2937a047613803b22e1ee1cec8eb6d28e80f190c4b8c8
-
SHA512
33422bef51caed74fd49d89589a3def0ed95c6852099916f62a419b233691c27a45a7a0fc53c3c8a8b6666d28a34ea465f04ca954e9e8dae54c0fdd90aafc3f5
-
SSDEEP
1536:dKGT5qBSbcBx3gQM8aBBksbEV4coGyN8Uu/Vf0VPoI2:dKGTo0OTWBBnbA4UK8TNcdz
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1020 netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2320 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2320 taskmgr.exe Token: SeDebugPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe Token: 33 3064 Toad.exe Token: SeIncBasePriorityPrivilege 3064 Toad.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1020 3064 Toad.exe 28 PID 3064 wrote to memory of 1020 3064 Toad.exe 28 PID 3064 wrote to memory of 1020 3064 Toad.exe 28 PID 3064 wrote to memory of 1020 3064 Toad.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Toad.exe"C:\Users\Admin\AppData\Local\Temp\Toad.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Toad.exe" "Toad.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:1020
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2320