Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c9836391eb08e1cfa33dd1094d2f993.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c9836391eb08e1cfa33dd1094d2f993.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
7c9836391eb08e1cfa33dd1094d2f993.exe
-
Size
52KB
-
MD5
7c9836391eb08e1cfa33dd1094d2f993
-
SHA1
4706caaa9058e37f7f72c5fb648b3156f879304d
-
SHA256
2554903f7c4f60ae4da51d76be6f122fb659c52ae564b51b4e25c15aa387a082
-
SHA512
439e19730022ad5f1141a8a476fd04eabc5fc3d92eb40efaae95ee9a1da85fbdf23387deb7878bba1749200cb144645961e289331f112d4992e3126b1972f07f
-
SSDEEP
768:FiQJYj+Rh7RYN6FncFuOmXplxkIwIDcJvST4cAoolCEd3D:UQJkSh7RYDuOmPw6cJWSonm
Score
7/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 7c9836391eb08e1cfa33dd1094d2f993.exe -
Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 7c9836391eb08e1cfa33dd1094d2f993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\notepad.exe %1" 7c9836391eb08e1cfa33dd1094d2f993.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 4612 7c9836391eb08e1cfa33dd1094d2f993.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4612 7c9836391eb08e1cfa33dd1094d2f993.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36 PID 4612 wrote to memory of 3556 4612 7c9836391eb08e1cfa33dd1094d2f993.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\7c9836391eb08e1cfa33dd1094d2f993.exe"C:\Users\Admin\AppData\Local\Temp\7c9836391eb08e1cfa33dd1094d2f993.exe"2⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
-