Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe
Resource
win10v2004-20230915-en
General
-
Target
eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe
-
Size
3.2MB
-
MD5
1df6290445b07011fdd666c60ad7896a
-
SHA1
f2bcd6dcd0d0ccccc079c7e32dc7c894351886f4
-
SHA256
eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a
-
SHA512
c0f6eb63868c9855542211dd47c8ab68865a03060da64b765e917b58c015b97b2f860de8d6848b111d2d403517e6bebc976f69e5d4bd4131ab1ee836dae16399
-
SSDEEP
49152:jcytmsA3LyH6id3JMccMLFP8PTAR5iTEPQSQy:jcMTIW6iNysUPTAvMSQ
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1704 eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1704 eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe 1704 eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe 1704 eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe"C:\Users\Admin\AppData\Local\Temp\eb5ee01db314473e629dc84d40681b38879ab760088a684eaa7e53c23988601a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1704