Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0095f47d4b0b5148f9c97edcfca8a1cf.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0095f47d4b0b5148f9c97edcfca8a1cf.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
0095f47d4b0b5148f9c97edcfca8a1cf.exe
-
Size
9KB
-
MD5
0095f47d4b0b5148f9c97edcfca8a1cf
-
SHA1
bee219929bba7236f0d5e30f56b1ee515387bfaf
-
SHA256
5e52b00379f4cf5324151e998fc3799cf9d2b708e79c3a868cdb2f4232140cab
-
SHA512
6c134da20a3a42315d8ab9fc4ae901776fdc2a9002a76fb77ff262a0771f1faf9274685c53676ddaa26c8b1a50e9074e82005100c3baeba430db9942e945e0a9
-
SSDEEP
192:0BksuXzHNQyseMZZ3Y93VnjdwqzO3GRm/a:jHFseM0FnhwqCWQ/
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2416 0095f47d4b0b5148f9c97edcfca8a1cf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2708 2416 0095f47d4b0b5148f9c97edcfca8a1cf.exe 28 PID 2416 wrote to memory of 2708 2416 0095f47d4b0b5148f9c97edcfca8a1cf.exe 28 PID 2416 wrote to memory of 2708 2416 0095f47d4b0b5148f9c97edcfca8a1cf.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0095f47d4b0b5148f9c97edcfca8a1cf.exe"C:\Users\Admin\AppData\Local\Temp\0095f47d4b0b5148f9c97edcfca8a1cf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2416 -s 9002⤵PID:2708
-