Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36e757339da0f68b1022a0897edb0791.exe
Resource
win7-20231129-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
36e757339da0f68b1022a0897edb0791.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
36e757339da0f68b1022a0897edb0791.exe
-
Size
57KB
-
MD5
36e757339da0f68b1022a0897edb0791
-
SHA1
b7e0a9c8d01c6f2830afa96851ea1880d11b7e1a
-
SHA256
5d5bf05d8607f7fccfbf7c5942f24abad1f42aec2b868b2828fb8a18ce7d2c61
-
SHA512
504924ff7a757a2be2c5ccf434602c2da078e5c11ced15a85b8fd5cdcbfd28c0022703495b90eb82584c14ac5ae148b2afa256884e1ce433ca2ab1bf24afaf84
-
SSDEEP
768:TkxciUrur/C3uYAKWKxFPpMxiebCEda04KmMcCAznCRh2y:Tkxcive5pWKxEsepF4KpcCAG72y
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RealtekSoftware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\36e757339da0f68b1022a0897edb0791.exe" 36e757339da0f68b1022a0897edb0791.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe 1484 36e757339da0f68b1022a0897edb0791.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1484 36e757339da0f68b1022a0897edb0791.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe Token: SeShutdownPrivilege 640 explorer.exe Token: SeCreatePagefilePrivilege 640 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1484 36e757339da0f68b1022a0897edb0791.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e757339da0f68b1022a0897edb0791.exe"C:\Users\Admin\AppData\Local\Temp\36e757339da0f68b1022a0897edb0791.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1484
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:640
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2180