Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
23/09/2023, 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
General
-
Target
setup.exe
-
Size
32.4MB
-
MD5
e0368699434af97ada8e5100d5d21d0c
-
SHA1
b1b1709664be14a6f0d5bb3a43fd19a7f4fd3586
-
SHA256
37a701c70cc853502b455a88a8e14ce3669fcb6325632560fb59b514dd1f96a8
-
SHA512
f55a4644635ec563d11ec2c901641ab99e0c885d40cb17a3227b5258318dec5d662c72ab139e5a766597c48e72bed1c5b5c87cc041d26ad21cda91e4bb8b32ee
-
SSDEEP
393216:BudOqgHWtfcf5DAh9m0LRiHrzSbGpmdXnfbm4vgOEKXDmft4kpf/ZrYsK1/QY48E:Bie2YxA1gUuth/ZrYfPDC
Score
1/10
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1428 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1968 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1968 taskmgr.exe Token: 33 1604 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1604 AUDIODG.EXE Token: 33 1604 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1604 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe 1968 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵PID:2092
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1968
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1224
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5801⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SyncShow.cmd1⤵
- Opens file in notepad (likely ransom note)
PID:1428
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\SyncShow.cmd" "1⤵PID:1888
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\RepairUnprotect.cmd" "1⤵PID:1460
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\Desktop\RepairUnprotect.cmd" "1⤵PID:1360