Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 04:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230915-en
12 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
673KB
-
MD5
86841a1ccb8603fd4c5f44ab5f978d4d
-
SHA1
00c814bca41e7da4e5694534dbafa6201484bc4e
-
SHA256
3096973acd0408ca6115b08d3e7968a5f029e353878991a39c22cc3f9d60683d
-
SHA512
519aa6b845a12d3f3a0b7cb6654796f2c08ea6f0912a9a1490fef52a39e535bfb57e44f7e19b974a3cd4e4ae6d185681de464a7924faf9511e6a4ff6abee425d
-
SSDEEP
12288:FrD6UaPEy03p4YIWo4FhXf0fDT2akV4+dcWTWNH5AyLY/VZ0K:1D/PJnIWo47p4QdTs5DYNWK
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2416 tmp.exe 2416 tmp.exe 2416 tmp.exe 2416 tmp.exe 2416 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2416 tmp.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2652 2416 tmp.exe 28 PID 2416 wrote to memory of 2652 2416 tmp.exe 28 PID 2416 wrote to memory of 2652 2416 tmp.exe 28 PID 2416 wrote to memory of 2652 2416 tmp.exe 28 PID 2416 wrote to memory of 2776 2416 tmp.exe 29 PID 2416 wrote to memory of 2776 2416 tmp.exe 29 PID 2416 wrote to memory of 2776 2416 tmp.exe 29 PID 2416 wrote to memory of 2776 2416 tmp.exe 29 PID 2416 wrote to memory of 2604 2416 tmp.exe 30 PID 2416 wrote to memory of 2604 2416 tmp.exe 30 PID 2416 wrote to memory of 2604 2416 tmp.exe 30 PID 2416 wrote to memory of 2604 2416 tmp.exe 30 PID 2416 wrote to memory of 2896 2416 tmp.exe 31 PID 2416 wrote to memory of 2896 2416 tmp.exe 31 PID 2416 wrote to memory of 2896 2416 tmp.exe 31 PID 2416 wrote to memory of 2896 2416 tmp.exe 31 PID 2416 wrote to memory of 2696 2416 tmp.exe 32 PID 2416 wrote to memory of 2696 2416 tmp.exe 32 PID 2416 wrote to memory of 2696 2416 tmp.exe 32 PID 2416 wrote to memory of 2696 2416 tmp.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵PID:2696
-