Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
234b27e2e44240ccae5cc4189a9a0209.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
234b27e2e44240ccae5cc4189a9a0209.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
234b27e2e44240ccae5cc4189a9a0209.exe
-
Size
9KB
-
MD5
234b27e2e44240ccae5cc4189a9a0209
-
SHA1
65d114cec9a74f9f4f7928501719ee80b7b9a72c
-
SHA256
f7b34c4d0891871f7c5599c8c0691f7f8a02f80df99e6ba854eac88361bcfb22
-
SHA512
486b24be42e1333e438ea05fda7702b7cfdfdfe995560bedd5b1e78e5f83778831f853fcdde45b6e8e3fc27017b951551f6831a426ef18167efaa065c88b154c
-
SSDEEP
192:nBksuDzHNQqyeMZZ3W93Vnjdwqzt3sGXG4s:oH9yeMiFnhwqRLG4
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1396 234b27e2e44240ccae5cc4189a9a0209.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1396 wrote to memory of 2700 1396 234b27e2e44240ccae5cc4189a9a0209.exe 28 PID 1396 wrote to memory of 2700 1396 234b27e2e44240ccae5cc4189a9a0209.exe 28 PID 1396 wrote to memory of 2700 1396 234b27e2e44240ccae5cc4189a9a0209.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\234b27e2e44240ccae5cc4189a9a0209.exe"C:\Users\Admin\AppData\Local\Temp\234b27e2e44240ccae5cc4189a9a0209.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1396 -s 9122⤵PID:2700
-