Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe
Resource
win10v2004-20231020-en
General
-
Target
88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe
-
Size
796KB
-
MD5
de84e870fbf45947fb8b2a7f6c348d48
-
SHA1
2f898086eb495a3dc91036682b8db6aa5a5ec290
-
SHA256
88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132
-
SHA512
4cf4fd7de69f6cbaaacc4fcd2d13a36f6d32b4437ee493c8795f62ffdb9157be3879984e082080f01d5858774282f8a2d0c4c97e7d0b775df8e63c204e7786a4
-
SSDEEP
24576:fF1rcwk/1afoFa7m1uWDuWREBAzae7E7WmArVA5oYD:32Jem15EBAz
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1148 88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1148 88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe Token: SeRestorePrivilege 1148 88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe Token: SeShutdownPrivilege 1148 88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe"C:\Users\Admin\AppData\Local\Temp\88543bd276a1d18cf901d54a305cdb330446c453d08f770565b312d88d097132.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1148