Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe
Resource
win10v2004-20240226-en
General
-
Target
0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe
-
Size
1.1MB
-
MD5
25cab131d1fd0ec832e9ea670e6d8b0f
-
SHA1
a6a0c6662a3d94d558635ac40f65e6eb42c976e0
-
SHA256
0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37
-
SHA512
a1060507c90e5aa6ad055d6a7a9eb45285b1c03fbf77a5433a6be135cc4ca9cf4b84d29ce3ce41a520f95bc98185210a31e93ea4ac9da0c9db2e650ae0808041
-
SSDEEP
24576:bcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:b5QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2992 0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe"C:\Users\Admin\AppData\Local\Temp\0c4a2ed5eb2b9214c92f48903526953a8208f6fd69803b4fc0a140c909fefa37.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5ab3e3736e02791fa65e21629af982adb
SHA1bf37040f8db5b187117d9235b908a284975d740a
SHA2565e48a04846ff698c91cd522ddf807ae6863dfa60144b65bf81cfe8e1fe4d27b7
SHA5123a5e05292a3eaaa1b47b4728f3d605414ffdb046ba63d9015c1d01a72d5690b53bdc134b297662a55d05276104643adcfd55cb4e8eb2bd2f1a45207697e905ab