Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 16:41
General
-
Target
2df142828348d2957d126f31e8343c04.exe
-
Size
1.3MB
-
MD5
2df142828348d2957d126f31e8343c04
-
SHA1
7d372595da310264871a00fd6dfb609afe052f5d
-
SHA256
22f35c559f9aee7f235f08b08003c36d9d7ca43240b47517a0b2aa0fe197135f
-
SHA512
221c76c0c5b32b633e6c167480c6ef693f0610c7f8afa591cb1cf17c4460b62ed7c0d5684953bf10e22d823eec3da5c1c36f442d448acd7a9fd81c2b19349750
-
SSDEEP
24576:UnIAiW5XlHXbH/l4dTPwz8uXq8xAE6g1xNjNx9ovXKAWqcCLxQpQ3KwsW3:CIKNBXkPvD8mE6g13NxSv6A/xAwp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Use of msiexec (install) with remote resource 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2df142828348d2957d126f31e8343c04.exe"C:\Users\Admin\AppData\Local\Temp\2df142828348d2957d126f31e8343c04.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vKr83A.exe"C:\Users\Admin\AppData\Local\Temp\vKr83A.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "http://setup.realtimegaming.com/36175/cdn/sunpalace/Sun Palace Casino20110901014501.msi" DDC_DID=685852 DDC_RTGURL=http://216.93.176.186/dl/TrackSetup/TrackSetup.aspx?DID=685852 DDC_UPDATESTATUSURL=http://196.40.83.82:8080/sunpalacecasino/Lobby.WebServices/Installer.asmx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="vKr83A.exe"3⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-