Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
12/12/2023, 02:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43605dbe1819b6fd2e180f942da4829b.exe
Resource
win7-20231020-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
43605dbe1819b6fd2e180f942da4829b.exe
Resource
win10v2004-20231127-en
5 signatures
150 seconds
General
-
Target
43605dbe1819b6fd2e180f942da4829b.exe
-
Size
254.0MB
-
MD5
43605dbe1819b6fd2e180f942da4829b
-
SHA1
44e91c9a1fdf38cc018e095c2090ae597cba355f
-
SHA256
e7d3bae9998776694d9511f9b5386c51702563209527938272de87748598c8f5
-
SHA512
3b87e6f1f13c407d512d32a944235a78ada2dee28c77c1e79991b62d1edfd4e4dfe2fbafcedc66e9d93dd138213a7a0bb00c520c02648dff7f25c0f1dd81e793
-
SSDEEP
196608:cKLuUSG6zb68WBuF4pcEUIq1qWBNoS4hipHZkdTZ4EAAy5YpS:IJie4pcfFKi5adTZoAyk
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2844 set thread context of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2060 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2060 vbc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28 PID 2844 wrote to memory of 2060 2844 43605dbe1819b6fd2e180f942da4829b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\43605dbe1819b6fd2e180f942da4829b.exe"C:\Users\Admin\AppData\Local\Temp\43605dbe1819b6fd2e180f942da4829b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-