Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 17:30

General

  • Target

    310acad7055a89b4e19063f6b5005da8.exe

  • Size

    107KB

  • MD5

    310acad7055a89b4e19063f6b5005da8

  • SHA1

    3464aadd82d7a20849411fefb9a3563c6de56ed3

  • SHA256

    34d1b680b8c0d363d8377322eba4f219e5e7c8035ff269403fadfdf3ad5e0fd9

  • SHA512

    68030bbf3cf7eaba859a410920237e8fb8746bfbeaccbecd71d965a7ae3cb4de3a3af15eea2fe4d0bd5ad99d316df3f33b696497a42042c0dfa5867f4638161c

  • SSDEEP

    3072:MfeTDCjc0Ea0uJEIWabNpJRSmx2YY7r8HdjG:MfeXCjc0Ea0hqT7Sm9Mr

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\310acad7055a89b4e19063f6b5005da8.exe
    "C:\Users\Admin\AppData\Local\Temp\310acad7055a89b4e19063f6b5005da8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\310acad7055a89b4e19063f6b5005da8.exe
      C:\Users\Admin\AppData\Local\Temp\310acad7055a89b4e19063f6b5005da8.exe
      2⤵
        PID:2996

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2376-0-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2376-2-0x0000000000260000-0x0000000000274000-memory.dmp

      Filesize

      80KB

    • memory/2376-1-0x0000000000AD0000-0x0000000000B50000-memory.dmp

      Filesize

      512KB

    • memory/2376-4-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

      Filesize

      9.6MB

    • memory/2376-3-0x0000000000270000-0x0000000000280000-memory.dmp

      Filesize

      64KB

    • memory/2376-5-0x0000000000250000-0x0000000000262000-memory.dmp

      Filesize

      72KB

    • memory/2376-6-0x0000000000AD0000-0x0000000000B50000-memory.dmp

      Filesize

      512KB

    • memory/2376-7-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

      Filesize

      9.6MB