Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e1f64a9bb9e7321c69c69260c13a4c8.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e1f64a9bb9e7321c69c69260c13a4c8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
7e1f64a9bb9e7321c69c69260c13a4c8.exe
-
Size
66KB
-
MD5
7e1f64a9bb9e7321c69c69260c13a4c8
-
SHA1
8995101d88d15ea0e2ea54461cfe2fec378729b8
-
SHA256
6f36bb4e75e7d5caff3acd723e04bc5d8ee80e7a61ece5d0f4019b0465743a96
-
SHA512
510ec5f744cba212e406b651fa19f317902f1e3b35df72044fed340c262466f9027fb6b429ee478e6136b665eef2692c23856544e5d2a7965e363b407cf9d9bb
-
SSDEEP
1536:2YyL+OZDfKnkas93F4UIYprEbrEj4mMqxVgW:txOZDUhsFFvGvhryn
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Download = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svohcst.exe" 7e1f64a9bb9e7321c69c69260c13a4c8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLoadDriverPrivilege 4672 7e1f64a9bb9e7321c69c69260c13a4c8.exe Token: SeLoadDriverPrivilege 112 7e1f64a9bb9e7321c69c69260c13a4c8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4672 wrote to memory of 112 4672 7e1f64a9bb9e7321c69c69260c13a4c8.exe 89 PID 4672 wrote to memory of 112 4672 7e1f64a9bb9e7321c69c69260c13a4c8.exe 89 PID 4672 wrote to memory of 112 4672 7e1f64a9bb9e7321c69c69260c13a4c8.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e1f64a9bb9e7321c69c69260c13a4c8.exe"C:\Users\Admin\AppData\Local\Temp\7e1f64a9bb9e7321c69c69260c13a4c8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\7e1f64a9bb9e7321c69c69260c13a4c8.exeC:\Users\Admin\AppData\Local\Temp\7e1f64a9bb9e7321c69c69260c13a4c8.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:112
-