Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vacuum (2) (2).exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Vacuum (2) (2).exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Vacuum (2) (2).exe
-
Size
6.0MB
-
MD5
dc112d6f1dffbd1f1049413a493c41b3
-
SHA1
3022f9f85d85735b000af193ae766b2576eee537
-
SHA256
43d0cd2a2ebaf029a98545e0cd3b0013ae7564fe9e0e19b378e67c8b0737d29e
-
SHA512
e47145277c4731a2ba513b699b2e1a380b7a3733658c2d7719d53a287f4a60f13a66dc8d14688282343dfbe7501d4d81ff71fdceadf012135de0ad5948fc3472
-
SSDEEP
98304:Yg09C7lJw/kngbjkEksToRep9fTqGAakUNP3e7NpGmtCgGig/XG+AhAXNhFg9e:MY7okn0rxqhak83MPfRQG+3Fgs
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3236 WMIC.exe Token: SeSecurityPrivilege 3236 WMIC.exe Token: SeTakeOwnershipPrivilege 3236 WMIC.exe Token: SeLoadDriverPrivilege 3236 WMIC.exe Token: SeSystemProfilePrivilege 3236 WMIC.exe Token: SeSystemtimePrivilege 3236 WMIC.exe Token: SeProfSingleProcessPrivilege 3236 WMIC.exe Token: SeIncBasePriorityPrivilege 3236 WMIC.exe Token: SeCreatePagefilePrivilege 3236 WMIC.exe Token: SeBackupPrivilege 3236 WMIC.exe Token: SeRestorePrivilege 3236 WMIC.exe Token: SeShutdownPrivilege 3236 WMIC.exe Token: SeDebugPrivilege 3236 WMIC.exe Token: SeSystemEnvironmentPrivilege 3236 WMIC.exe Token: SeRemoteShutdownPrivilege 3236 WMIC.exe Token: SeUndockPrivilege 3236 WMIC.exe Token: SeManageVolumePrivilege 3236 WMIC.exe Token: 33 3236 WMIC.exe Token: 34 3236 WMIC.exe Token: 35 3236 WMIC.exe Token: 36 3236 WMIC.exe Token: SeIncreaseQuotaPrivilege 3236 WMIC.exe Token: SeSecurityPrivilege 3236 WMIC.exe Token: SeTakeOwnershipPrivilege 3236 WMIC.exe Token: SeLoadDriverPrivilege 3236 WMIC.exe Token: SeSystemProfilePrivilege 3236 WMIC.exe Token: SeSystemtimePrivilege 3236 WMIC.exe Token: SeProfSingleProcessPrivilege 3236 WMIC.exe Token: SeIncBasePriorityPrivilege 3236 WMIC.exe Token: SeCreatePagefilePrivilege 3236 WMIC.exe Token: SeBackupPrivilege 3236 WMIC.exe Token: SeRestorePrivilege 3236 WMIC.exe Token: SeShutdownPrivilege 3236 WMIC.exe Token: SeDebugPrivilege 3236 WMIC.exe Token: SeSystemEnvironmentPrivilege 3236 WMIC.exe Token: SeRemoteShutdownPrivilege 3236 WMIC.exe Token: SeUndockPrivilege 3236 WMIC.exe Token: SeManageVolumePrivilege 3236 WMIC.exe Token: 33 3236 WMIC.exe Token: 34 3236 WMIC.exe Token: 35 3236 WMIC.exe Token: 36 3236 WMIC.exe Token: SeIncreaseQuotaPrivilege 2392 WMIC.exe Token: SeSecurityPrivilege 2392 WMIC.exe Token: SeTakeOwnershipPrivilege 2392 WMIC.exe Token: SeLoadDriverPrivilege 2392 WMIC.exe Token: SeSystemProfilePrivilege 2392 WMIC.exe Token: SeSystemtimePrivilege 2392 WMIC.exe Token: SeProfSingleProcessPrivilege 2392 WMIC.exe Token: SeIncBasePriorityPrivilege 2392 WMIC.exe Token: SeCreatePagefilePrivilege 2392 WMIC.exe Token: SeBackupPrivilege 2392 WMIC.exe Token: SeRestorePrivilege 2392 WMIC.exe Token: SeShutdownPrivilege 2392 WMIC.exe Token: SeDebugPrivilege 2392 WMIC.exe Token: SeSystemEnvironmentPrivilege 2392 WMIC.exe Token: SeRemoteShutdownPrivilege 2392 WMIC.exe Token: SeUndockPrivilege 2392 WMIC.exe Token: SeManageVolumePrivilege 2392 WMIC.exe Token: 33 2392 WMIC.exe Token: 34 2392 WMIC.exe Token: 35 2392 WMIC.exe Token: 36 2392 WMIC.exe Token: SeIncreaseQuotaPrivilege 2392 WMIC.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4668 wrote to memory of 1580 4668 Vacuum (2) (2).exe 92 PID 4668 wrote to memory of 1580 4668 Vacuum (2) (2).exe 92 PID 1580 wrote to memory of 3236 1580 cmd.exe 93 PID 1580 wrote to memory of 3236 1580 cmd.exe 93 PID 4668 wrote to memory of 4852 4668 Vacuum (2) (2).exe 96 PID 4668 wrote to memory of 4852 4668 Vacuum (2) (2).exe 96 PID 4852 wrote to memory of 2392 4852 cmd.exe 97 PID 4852 wrote to memory of 2392 4852 cmd.exe 97 PID 4668 wrote to memory of 2560 4668 Vacuum (2) (2).exe 99 PID 4668 wrote to memory of 2560 4668 Vacuum (2) (2).exe 99 PID 2560 wrote to memory of 936 2560 cmd.exe 100 PID 2560 wrote to memory of 936 2560 cmd.exe 100 PID 4668 wrote to memory of 2104 4668 Vacuum (2) (2).exe 101 PID 4668 wrote to memory of 2104 4668 Vacuum (2) (2).exe 101 PID 2104 wrote to memory of 2176 2104 cmd.exe 103 PID 2104 wrote to memory of 2176 2104 cmd.exe 103 PID 4668 wrote to memory of 1380 4668 Vacuum (2) (2).exe 104 PID 4668 wrote to memory of 1380 4668 Vacuum (2) (2).exe 104 PID 1380 wrote to memory of 4160 1380 cmd.exe 106 PID 1380 wrote to memory of 4160 1380 cmd.exe 106 PID 4668 wrote to memory of 1660 4668 Vacuum (2) (2).exe 109 PID 4668 wrote to memory of 1660 4668 Vacuum (2) (2).exe 109 PID 1660 wrote to memory of 2964 1660 cmd.exe 108 PID 1660 wrote to memory of 2964 1660 cmd.exe 108 PID 4668 wrote to memory of 3504 4668 Vacuum (2) (2).exe 110 PID 4668 wrote to memory of 3504 4668 Vacuum (2) (2).exe 110 PID 3504 wrote to memory of 1352 3504 cmd.exe 112 PID 3504 wrote to memory of 1352 3504 cmd.exe 112 PID 4668 wrote to memory of 3972 4668 Vacuum (2) (2).exe 114 PID 4668 wrote to memory of 3972 4668 Vacuum (2) (2).exe 114 PID 3972 wrote to memory of 4396 3972 cmd.exe 115 PID 3972 wrote to memory of 4396 3972 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vacuum (2) (2).exe"C:\Users\Admin\AppData\Local\Temp\Vacuum (2) (2).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic path Win32_videocontroller get PNPDeviceID2⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_videocontroller get PNPDeviceID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic CPU get Architecture2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\System32\Wbem\WMIC.exewmic CPU get Architecture3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic logicaldisk get volumeserialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get volumeserialnumber3⤵PID:936
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵PID:2176
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic path Win32_videocontroller get PNPDeviceID2⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_videocontroller get PNPDeviceID3⤵PID:4160
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic CPU get Architecture2⤵
- Suspicious use of WriteProcessMemory
PID:1660
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic logicaldisk get volumeserialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get volumeserialnumber3⤵PID:1352
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵PID:4396
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get Architecture1⤵PID:2964