Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe
Resource
win10v2004-20230824-en
General
-
Target
db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe
-
Size
1.3MB
-
MD5
53875a9d069f2c9fa8fceb5afe193784
-
SHA1
be79b96f58bda083e766995c261100344f1976a4
-
SHA256
db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d
-
SHA512
6c9d9ac9887339d562ab53ace4f451ff61f069c2764f85b34881e8815afaee5f5e6d73fdfb463640221a91ea8eee13941343995eca89ab55dffb5a991eac25a3
-
SSDEEP
24576:NPRJL++VMcS5vEZfbcxpdSscfgTn+8Qa1DJFqSDy7D9O:NTLXS5vmIxp/+Fa17VDow
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2640 db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2640 db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2640 db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe 2640 db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe"C:\Users\Admin\AppData\Local\Temp\db1cf9e79930e71a7b300bbe9f5fa680e3acc7681f8847b98dd1898ca30cbc7d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2640