Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2023, 03:37
Static task
static1
Behavioral task
behavioral1
Sample
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
Resource
win10v2004-20231020-en
General
-
Target
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe
-
Size
4.5MB
-
MD5
5b9199d8d78e1f243dd06650ea280d2b
-
SHA1
c9ea60db6995c7601831eb53392f35ddeeeec019
-
SHA256
5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a
-
SHA512
1a3340e7b9cf03ab73fc04eee7b6a5cd6883027b19ec9373fa15f74b2d75065ed71972be4572c2cda61f05174f3d4f121676fdae05ebaf6e2144904c1efa9813
-
SSDEEP
98304:WHBlU61iNt6x9G7phImiaE9YwciOWdQ/kJFpMExVMU:WHTU6QW9yImi2rWOk3xy
Malware Config
Signatures
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2352-21-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-30-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-260-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-278-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-279-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-280-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-281-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-282-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-283-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-284-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-285-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-286-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-287-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-288-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-289-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe behavioral2/memory/2352-290-0x0000000000400000-0x0000000001001000-memory.dmp autoit_exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 2352 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe Token: SeRestorePrivilege 2352 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe Token: 33 2352 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe Token: SeIncBasePriorityPrivilege 2352 5946a1230d1dcdb5190b7dfb15c6b7640f96f6144a8aaa45a5fe303c47e2515a.exe