Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe
Resource
win10v2004-20230703-en
General
-
Target
5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe
-
Size
3.1MB
-
MD5
c85adeb3ee700b59b5d6c72d0f44b82d
-
SHA1
b714efd1b435dde165e3818ede5713e2c6a270c2
-
SHA256
5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5
-
SHA512
eb36831a13a8972431c6c49771e4e49f39b5258d9f0864e8805f8a952d5e83152323183c2495aa15bb719d58271ab0bed6080a586e78eba4c084a41e9c71059d
-
SSDEEP
98304:QYR+qLAgJ1eOVlxABnqlIfLjTgf+hVpUBZ24HZGI3fT0JMKeMigqN24Ie+dFdAtu:QYR+qLAgJ1eOVlxA5qlIfLjTgf+hVpUO
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1492-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-54-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-56-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-64-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-66-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-68-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-71-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-73-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-75-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-80-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-78-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-82-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-86-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-84-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-88-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-90-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-92-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-94-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-96-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-98-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1492-99-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1492 5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1492 5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe 1492 5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe 1492 5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe"C:\Users\Admin\AppData\Local\Temp\5edff32e0c72ef3a0b1523a6c552881bb5328d861e56f81625d218b0fe7b52a5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1492