Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
1a4a36a0e7f4036c781b2c792322ab16.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1a4a36a0e7f4036c781b2c792322ab16.exe
Resource
win10v2004-20231215-en
General
-
Target
1a4a36a0e7f4036c781b2c792322ab16.exe
-
Size
602KB
-
MD5
1a4a36a0e7f4036c781b2c792322ab16
-
SHA1
bd9902567a6179433cbcee08ff555011ec90ec03
-
SHA256
49b3e108316cc7864d517d86061d6e7b3b53bd2652c08528f70908607f0975a7
-
SHA512
dd9bed4181107e213e1947375e7b47e22afd5a278edd4b65fb375fed598861b730ce7e9e13a8ec7b3e9fb7f0ec9b0ba5090ccd562a4737bb1e15ee3f9a8957ac
-
SSDEEP
12288:amk1GlMbi6smHy/wM6jXTQDC0sZDtt+lmEZc9dkqCVVqvNH/NDxCql:af1rbiwywBXTPZGlw9dhCyxNDg
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2068-2-0x0000000002370000-0x0000000002498000-memory.dmp upx behavioral2/memory/2068-1-0x0000000002370000-0x0000000002498000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2068 1a4a36a0e7f4036c781b2c792322ab16.exe 2068 1a4a36a0e7f4036c781b2c792322ab16.exe 2068 1a4a36a0e7f4036c781b2c792322ab16.exe 2068 1a4a36a0e7f4036c781b2c792322ab16.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2068 1a4a36a0e7f4036c781b2c792322ab16.exe Token: SeCreatePagefilePrivilege 2068 1a4a36a0e7f4036c781b2c792322ab16.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2068 1a4a36a0e7f4036c781b2c792322ab16.exe 2068 1a4a36a0e7f4036c781b2c792322ab16.exe