Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 20:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11832aaaea01ab2ab4f4bbef2792335a.exe
Resource
win7-20231215-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
11832aaaea01ab2ab4f4bbef2792335a.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
11832aaaea01ab2ab4f4bbef2792335a.exe
-
Size
4.5MB
-
MD5
11832aaaea01ab2ab4f4bbef2792335a
-
SHA1
b086b6796613307e4fc109f224eb9f3550e0d3b4
-
SHA256
e44253c39391bb28f346dd98d874e4587a34ecec25cc920ddcf60751cd1bfdc4
-
SHA512
76c967665ccf20bcdeda6ffab8e0f29929605c3b9e80bb24f9c25f38f3c1674932e65afba486499aac2bce8cb871bfa8a6cd56ee9e78887ac8cd113a39d50286
-
SSDEEP
98304:5MGf2jqPwejTT9k7lw3lgIJm1PBMckd00ZTz+LX2yC0DX:Ff2jqBTG7lw36r1PSna0ZiXD7
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4284 468 WerFault.exe 87 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 468 11832aaaea01ab2ab4f4bbef2792335a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 468 11832aaaea01ab2ab4f4bbef2792335a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11832aaaea01ab2ab4f4bbef2792335a.exe"C:\Users\Admin\AppData\Local\Temp\11832aaaea01ab2ab4f4bbef2792335a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 5962⤵
- Program crash
PID:4284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 468 -ip 4681⤵PID:4784