Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe
Resource
win10v2004-20230703-en
General
-
Target
b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe
-
Size
821KB
-
MD5
8b8f191e4667c74bf875c43b0197d58d
-
SHA1
5b25644ef3128ca3ec243bf56174f6d05e6a48b4
-
SHA256
b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9
-
SHA512
d2bf9f971c87ccfabb2dd89ad55449033b7bca9a424964b925ca77982c7f4eb54aca2b986b4277e7dfa876fe0fb0a0cb42ab8910aef25d6b89b3711befeda27a
-
SSDEEP
24576:7NzQwe9wKh5aY0qsyUqyhzIUuRyKQv6ht:7rKdsyUBsRQK
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1876-0-0x0000000010000000-0x0000000010018000-memory.dmp upx behavioral1/memory/1876-1-0x0000000010000000-0x0000000010018000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1876 b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe Token: SeDebugPrivilege 1876 b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1876 b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe 1876 b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe"C:\Users\Admin\AppData\Local\Temp\b8eeb271dcb2ea04939c95b242addd532a6706698c0d3a7c80f43d3a6c0f2fc9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1876