Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/01/2024, 12:13
General
-
Target
4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540.exe
-
Size
536KB
-
MD5
ba87e864b94b3898b41f70784214ccd1
-
SHA1
a2e1f5ef52c5d3c187a1ba52f3d7631cedeb1e3c
-
SHA256
4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540
-
SHA512
84095845e50f71d40421efd9b5569ee0261be34ef59dadbf53c053470e2226b38353043fa75cf379745c566a17c3ee58cb2f384103cfa186ef1cecf134b89130
-
SSDEEP
12288:Nhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:NdQyDL9xp/BGA1RkmOkx2LF
Score
7/10
Malware Config
Signatures
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540.exe"C:\Users\Admin\AppData\Local\Temp\4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB