Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40eafc0c9230e7950475f270074ade76.exe
Resource
win7-20231215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
40eafc0c9230e7950475f270074ade76.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
40eafc0c9230e7950475f270074ade76.exe
-
Size
650KB
-
MD5
40eafc0c9230e7950475f270074ade76
-
SHA1
28cc9da0682b5c41034be57203694d2df7692e64
-
SHA256
04fdfdf3e5df042836c473a602a721a88064dc3b48f5e37f6163eeeaff85a56b
-
SHA512
e3ad17b750982d76b8eb327f5e74043890b467c81e80d2c347f072d6b1d41c0181ddf577f48bb5d8806e2b9ab987e2a8147cadb73373d149da5430c7c0bdc573
-
SSDEEP
12288:BJfs43cm0ze8WSDrIllm8H9KikqM2Sv2Mk6V8S5oRKDNEvH:BJfs+cGZSDrilzdKikqMLjV3E
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2112-10-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-13-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-105-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-107-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-109-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-108-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-111-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-110-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-106-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-115-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-12-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-7-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-174-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-171-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-170-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-177-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-178-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-180-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-179-0x0000000002370000-0x00000000024A4000-memory.dmp upx behavioral2/memory/2112-183-0x0000000002370000-0x00000000024A4000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2112 40eafc0c9230e7950475f270074ade76.exe 2112 40eafc0c9230e7950475f270074ade76.exe 2112 40eafc0c9230e7950475f270074ade76.exe 2112 40eafc0c9230e7950475f270074ade76.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2112 40eafc0c9230e7950475f270074ade76.exe Token: SeCreatePagefilePrivilege 2112 40eafc0c9230e7950475f270074ade76.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2112 40eafc0c9230e7950475f270074ade76.exe 2112 40eafc0c9230e7950475f270074ade76.exe