Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
369316e575cc105bf300d63226392410.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
369316e575cc105bf300d63226392410.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
369316e575cc105bf300d63226392410.exe
-
Size
65KB
-
MD5
369316e575cc105bf300d63226392410
-
SHA1
aeb9116975d7bfeb001d9ad5a2bc0590336ea9d9
-
SHA256
1767126f35737c858d2d4abf0c5b109447b3a25eac6ab98782f9528fc1d88179
-
SHA512
b8ba53037685de3c5a0924eae1c0d2d296a63341ba1ef6a71a0570c880031c194b37e68385f1c37a4c29ba5e0eb98bf8f0856d6f0e29b1b1667858f374ae5cd5
-
SSDEEP
1536:jtf77AEBaoVsz16Anz3pIFhy55KChEE1o3q3G/h95:jOEBaoVsx6An7ucBeq6
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3216 369316e575cc105bf300d63226392410.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3216 wrote to memory of 2328 3216 369316e575cc105bf300d63226392410.exe 93 PID 3216 wrote to memory of 2328 3216 369316e575cc105bf300d63226392410.exe 93 PID 3216 wrote to memory of 2328 3216 369316e575cc105bf300d63226392410.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\369316e575cc105bf300d63226392410.exe"C:\Users\Admin\AppData\Local\Temp\369316e575cc105bf300d63226392410.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\arp.exe"C:\Windows\System32\arp.exe" -a2⤵PID:2328
-