Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
796dac6ac117343d0bd4708a8c3ad214.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
796dac6ac117343d0bd4708a8c3ad214.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
796dac6ac117343d0bd4708a8c3ad214.exe
-
Size
1.0MB
-
MD5
796dac6ac117343d0bd4708a8c3ad214
-
SHA1
7b2a868868ccb1f6d6215aea86cd95ee0c37146f
-
SHA256
899a0a25423c5c477dcb28a3875c69e659c186212548f7256d0c742ec8cc5f1f
-
SHA512
14f1cffd5a157a8acdd2d8c2ff6ea514afb653a480ce829bae9336f82db4d1815ddaadf9161d3ac82d35d7017885a6b735b04fb006423c7442f456931e78a7eb
-
SSDEEP
12288:Pyelr1qy7aEVug/pKPYcVmWbWyj0QLHpXwFhInPo4ERsqS:Pfd1qyaEVuRPQnyjT1wzInP
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2356 796dac6ac117343d0bd4708a8c3ad214.exe 2356 796dac6ac117343d0bd4708a8c3ad214.exe 2356 796dac6ac117343d0bd4708a8c3ad214.exe 2356 796dac6ac117343d0bd4708a8c3ad214.exe 2356 796dac6ac117343d0bd4708a8c3ad214.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2356 796dac6ac117343d0bd4708a8c3ad214.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2400 2356 796dac6ac117343d0bd4708a8c3ad214.exe 28 PID 2356 wrote to memory of 2400 2356 796dac6ac117343d0bd4708a8c3ad214.exe 28 PID 2356 wrote to memory of 2400 2356 796dac6ac117343d0bd4708a8c3ad214.exe 28 PID 2356 wrote to memory of 2400 2356 796dac6ac117343d0bd4708a8c3ad214.exe 28 PID 2356 wrote to memory of 2856 2356 796dac6ac117343d0bd4708a8c3ad214.exe 29 PID 2356 wrote to memory of 2856 2356 796dac6ac117343d0bd4708a8c3ad214.exe 29 PID 2356 wrote to memory of 2856 2356 796dac6ac117343d0bd4708a8c3ad214.exe 29 PID 2356 wrote to memory of 2856 2356 796dac6ac117343d0bd4708a8c3ad214.exe 29 PID 2356 wrote to memory of 2828 2356 796dac6ac117343d0bd4708a8c3ad214.exe 30 PID 2356 wrote to memory of 2828 2356 796dac6ac117343d0bd4708a8c3ad214.exe 30 PID 2356 wrote to memory of 2828 2356 796dac6ac117343d0bd4708a8c3ad214.exe 30 PID 2356 wrote to memory of 2828 2356 796dac6ac117343d0bd4708a8c3ad214.exe 30 PID 2356 wrote to memory of 2616 2356 796dac6ac117343d0bd4708a8c3ad214.exe 31 PID 2356 wrote to memory of 2616 2356 796dac6ac117343d0bd4708a8c3ad214.exe 31 PID 2356 wrote to memory of 2616 2356 796dac6ac117343d0bd4708a8c3ad214.exe 31 PID 2356 wrote to memory of 2616 2356 796dac6ac117343d0bd4708a8c3ad214.exe 31 PID 2356 wrote to memory of 2868 2356 796dac6ac117343d0bd4708a8c3ad214.exe 32 PID 2356 wrote to memory of 2868 2356 796dac6ac117343d0bd4708a8c3ad214.exe 32 PID 2356 wrote to memory of 2868 2356 796dac6ac117343d0bd4708a8c3ad214.exe 32 PID 2356 wrote to memory of 2868 2356 796dac6ac117343d0bd4708a8c3ad214.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"2⤵PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"2⤵PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"2⤵PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"2⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"2⤵PID:2868
-