Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c9798ebe1b0efac57219d27279dcf80.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c9798ebe1b0efac57219d27279dcf80.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7c9798ebe1b0efac57219d27279dcf80.exe
-
Size
9KB
-
MD5
7c9798ebe1b0efac57219d27279dcf80
-
SHA1
6f5c02c7b6608c7db4e4886d05e90a4db07dc21e
-
SHA256
4d0169f7fc9c4e006db6e3e698c7f94a81f0602c749093dc0e07f310bd436d84
-
SHA512
91e8eed79e4e51911fdbcfdb7de3cc14478ad52b2cafc84d663db165fb1f0e65cb18bdd465b681f938cd2804efe22c8253675a573a16546b476a7a3d33ac95cb
-
SSDEEP
192:/TqSywxoc85G+negATrA5Wz+f1BKW8QKPWQA:/TqSxInegAXKsW8QKPWQA
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\delttsul = "C:\\Windows\\System32\\delttsul.exe" 7c9798ebe1b0efac57219d27279dcf80.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: 33 1544 7c9798ebe1b0efac57219d27279dcf80.exe Token: SeIncBasePriorityPrivilege 1544 7c9798ebe1b0efac57219d27279dcf80.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1544 7c9798ebe1b0efac57219d27279dcf80.exe