Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/08/2023, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe
Resource
win10v2004-20230703-en
General
-
Target
cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe
-
Size
655KB
-
MD5
3b05b28e50e59bc98099fb9b59e931c6
-
SHA1
ff38bdb43c8b3bd2727fcea609b8d32ceb1316b9
-
SHA256
cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a
-
SHA512
50329d88f9d8c595cbc963336ad0fa4619cf5092962df3b6b6fb73ac4be7fa0c8070bedb7259613f73cb4a77303a69a6fac1c7a5dcaa76ca162c0925fda951f9
-
SSDEEP
12288:9F700JD+IU4gY7kerA2tk1/+7guOp38fca+dfkKMXXVf8:H70RG7JrA7t+SKV0chHW
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2068 2584 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2584 cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2068 2584 cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe 28 PID 2584 wrote to memory of 2068 2584 cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe 28 PID 2584 wrote to memory of 2068 2584 cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe 28 PID 2584 wrote to memory of 2068 2584 cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe"C:\Users\Admin\AppData\Local\Temp\cd302da7e6d70c6292aab530d5ea509fb06ddcecc00cc7e8db9030d4a41f4d1a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 5802⤵
- Program crash
PID:2068
-