Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 02:15
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230712-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
sample.exe
-
Size
4.0MB
-
MD5
2ab97f6e8da5c93723172bec26acc84e
-
SHA1
e657a858f9c2036a5a832ce83989bebfee07b8b5
-
SHA256
33f79acb1c60bb51ade48f700837bba1ad2abca99f49b1321e446f9d5f89a32d
-
SHA512
5bf3b3bb061c8b4840952117211d8e45d903af6628086336848920c6b9c8114d49cf9ff92b2eaf6ef8b0b3ba8c7c6b71f9996e83cce7b9de951dc61dc8b01b9b
-
SSDEEP
98304:y/s+iUW/zL/K9/Nuu5th4+YnM6d5WAJOp2Nyl:9+UkYKtk5BOANyl
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1296-133-0x0000000000400000-0x0000000000E30000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1300 taskmgr.exe Token: SeSystemProfilePrivilege 1300 taskmgr.exe Token: SeCreateGlobalPrivilege 1300 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe 1300 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵PID:1296
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1300