Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 20:52
Behavioral task
behavioral1
Sample
b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe
-
Size
1.6MB
-
MD5
1ec34949c3a5bb416cc10494e149fe29
-
SHA1
b030f2a7dfb0bdcdccf044564371f3ccbdaf111a
-
SHA256
b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94
-
SHA512
2c10fa5d05a31f363bb292c7f16775c0a22eb55edbb45e925b9aceacc57288e1fc65f6d5f1841b1859ceda029f18f136fc02778977b7740b86f8abfaefca8d7a
-
SSDEEP
24576:pyp5A7mG8ms2/BYre5fvN6y7gM4h8KAGUvu9t4ssA4MahS0VXzAK1JaUdx/j1WCf:p45LoZqe9vnLM8II355aqnP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2852-0-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-1-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-3-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-4-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-5-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-6-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-7-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-8-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-9-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-10-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-11-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-12-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-13-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-14-0x0000000000400000-0x0000000000B2D000-memory.dmp upx behavioral1/memory/2852-15-0x0000000000400000-0x0000000000B2D000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: 33 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe Token: SeIncBasePriorityPrivilege 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe 2852 b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe"C:\Users\Admin\AppData\Local\Temp\b99fda83c3f63f8b04d706958cbd98eac14e808010035d67c79074196450de94.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2852