Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PURCHASE.exe
Resource
win7-20230712-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PURCHASE.exe
Resource
win10v2004-20230703-en
4 signatures
150 seconds
General
-
Target
PURCHASE.exe
-
Size
852KB
-
MD5
d1cd47f7c1b362dd9f478ad795596180
-
SHA1
629f14639425f40e3ad081e4fcb0b4238e4f40d1
-
SHA256
325af2369691a45f5421d141a8b4e7d5a1a1bc28bce159ccc421daabaec846fe
-
SHA512
df80b30f5822bc106cc3781609ffdc922faa4d5496ae2b20d6e85f0bbd0d63b7b44f39a61e0dd63ee6467aa5dc147d04466e74a491677bd8bb6f65e7a168b1b3
-
SSDEEP
24576:Fo/thewlqB6p9+KJHHxQcRy93RvsB3VuCXdY:6e2q8p93Qb93R03n
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3640 set thread context of 5100 3640 PURCHASE.exe 97 -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3640 PURCHASE.exe 3640 PURCHASE.exe 3640 PURCHASE.exe 3640 PURCHASE.exe 3640 PURCHASE.exe 3640 PURCHASE.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe 5100 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3640 PURCHASE.exe Token: SeDebugPrivilege 5100 MSBuild.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3640 wrote to memory of 544 3640 PURCHASE.exe 94 PID 3640 wrote to memory of 544 3640 PURCHASE.exe 94 PID 3640 wrote to memory of 544 3640 PURCHASE.exe 94 PID 3640 wrote to memory of 1108 3640 PURCHASE.exe 95 PID 3640 wrote to memory of 1108 3640 PURCHASE.exe 95 PID 3640 wrote to memory of 1108 3640 PURCHASE.exe 95 PID 3640 wrote to memory of 3924 3640 PURCHASE.exe 96 PID 3640 wrote to memory of 3924 3640 PURCHASE.exe 96 PID 3640 wrote to memory of 3924 3640 PURCHASE.exe 96 PID 3640 wrote to memory of 5100 3640 PURCHASE.exe 97 PID 3640 wrote to memory of 5100 3640 PURCHASE.exe 97 PID 3640 wrote to memory of 5100 3640 PURCHASE.exe 97 PID 3640 wrote to memory of 5100 3640 PURCHASE.exe 97 PID 3640 wrote to memory of 5100 3640 PURCHASE.exe 97 PID 3640 wrote to memory of 5100 3640 PURCHASE.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:1108
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:3924
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-