Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
319s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
Stardock.ObjectDock.Plus.v2.01.743 [PeskTop.com].rar
Resource
win7-20240221-en
5 signatures
300 seconds
General
-
Target
Stardock.ObjectDock.Plus.v2.01.743 [PeskTop.com].rar
-
Size
15.1MB
-
MD5
691c687cd95f173ba579323df1b81caf
-
SHA1
5954fee906fe54f8e0e86e0effde1420e2cb5c73
-
SHA256
d89504dcd16ff4e93cd4858637b7b0e71c845e42b3ee9f59cf03b954ec6a1107
-
SHA512
12c0300958383159051b86f30989746d6e33874fadb49caa82ee334082528bd618e76b9514f189c654130b8196ae8c172094d7a6a4d5f51a390777a0c0742b1f
-
SSDEEP
393216:KH/u79aupAJuEfBU8LF2ygBcpugXMsZZFxljgE1bSh9:K/uxawgBU8x2yIcpuUVl8E1bS7
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2872 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2872 7zFM.exe Token: 35 2872 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2872 2640 cmd.exe 30 PID 2640 wrote to memory of 2872 2640 cmd.exe 30 PID 2640 wrote to memory of 2872 2640 cmd.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Stardock.ObjectDock.Plus.v2.01.743 [PeskTop.com].rar"1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Stardock.ObjectDock.Plus.v2.01.743 [PeskTop.com].rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872
-