Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a15bccc6eb292982e32a18ab10b520c.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a15bccc6eb292982e32a18ab10b520c.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
4a15bccc6eb292982e32a18ab10b520c.exe
-
Size
88KB
-
MD5
4a15bccc6eb292982e32a18ab10b520c
-
SHA1
bed9316b082f62ee15a473a1fcca922c055b2833
-
SHA256
3bcaa928533ae452f8a3d052d165eff24289cbde9283c54f90a206403f0b1a1d
-
SHA512
0f07669d2416d842f00714c081422cac061f01e5ccfbc33eaf05e5ac9c6434e9d4edeee0ef355c9b84de5e193fcb1444084bb096f5a17a00e45c27ab9257b1f4
-
SSDEEP
1536:ZexK+2H3td9lWixUP4VQpiphWQYjpHScmASqVF+nk+ml+9w8:gK+279siU4Cg8mkVF+k/8
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1540 4a15bccc6eb292982e32a18ab10b520c.exe 1540 4a15bccc6eb292982e32a18ab10b520c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1540 4a15bccc6eb292982e32a18ab10b520c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2072 1540 4a15bccc6eb292982e32a18ab10b520c.exe 28 PID 1540 wrote to memory of 2072 1540 4a15bccc6eb292982e32a18ab10b520c.exe 28 PID 1540 wrote to memory of 2072 1540 4a15bccc6eb292982e32a18ab10b520c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a15bccc6eb292982e32a18ab10b520c.exe"C:\Users\Admin\AppData\Local\Temp\4a15bccc6eb292982e32a18ab10b520c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1540 -s 5202⤵PID:2072
-