Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Request for Quote.dox.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Request for Quote.dox.exe
Resource
win10v2004-20231215-en
11 signatures
150 seconds
General
-
Target
Request for Quote.dox.exe
-
Size
915KB
-
MD5
133fe057686ada7d4e07500c6fca8072
-
SHA1
c7fcd044a6f2e1daf9ef68c500d36e49dd814dbc
-
SHA256
0d9482728211478fca475c41feb82fc18040801f2ac7210e0bd83491ce1f39cb
-
SHA512
e1897d719d30dcb9b70ab08eccc12d46803ba486d2718c1ceea3741f830e734e13d11bcdff4e7d4c45df74f2c34b9d557dd2370901031c055be3c57419b6bb9d
-
SSDEEP
12288:swmi0C0e6DjNG1qR0YdgYwegIdNf7lh124bJ80rQ:Z0R/TJLf7jJ
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2108 Request for Quote.dox.exe 2108 Request for Quote.dox.exe 2108 Request for Quote.dox.exe 2108 Request for Quote.dox.exe 2108 Request for Quote.dox.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2108 Request for Quote.dox.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2748 2108 Request for Quote.dox.exe 28 PID 2108 wrote to memory of 2748 2108 Request for Quote.dox.exe 28 PID 2108 wrote to memory of 2748 2108 Request for Quote.dox.exe 28 PID 2108 wrote to memory of 2748 2108 Request for Quote.dox.exe 28 PID 2108 wrote to memory of 2796 2108 Request for Quote.dox.exe 29 PID 2108 wrote to memory of 2796 2108 Request for Quote.dox.exe 29 PID 2108 wrote to memory of 2796 2108 Request for Quote.dox.exe 29 PID 2108 wrote to memory of 2796 2108 Request for Quote.dox.exe 29 PID 2108 wrote to memory of 2800 2108 Request for Quote.dox.exe 30 PID 2108 wrote to memory of 2800 2108 Request for Quote.dox.exe 30 PID 2108 wrote to memory of 2800 2108 Request for Quote.dox.exe 30 PID 2108 wrote to memory of 2800 2108 Request for Quote.dox.exe 30 PID 2108 wrote to memory of 2816 2108 Request for Quote.dox.exe 31 PID 2108 wrote to memory of 2816 2108 Request for Quote.dox.exe 31 PID 2108 wrote to memory of 2816 2108 Request for Quote.dox.exe 31 PID 2108 wrote to memory of 2816 2108 Request for Quote.dox.exe 31 PID 2108 wrote to memory of 2832 2108 Request for Quote.dox.exe 32 PID 2108 wrote to memory of 2832 2108 Request for Quote.dox.exe 32 PID 2108 wrote to memory of 2832 2108 Request for Quote.dox.exe 32 PID 2108 wrote to memory of 2832 2108 Request for Quote.dox.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Request for Quote.dox.exe"C:\Users\Admin\AppData\Local\Temp\Request for Quote.dox.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2832
-