Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe
Resource
win10v2004-20240226-en
General
-
Target
8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe
-
Size
1.1MB
-
MD5
360aef94770059c75aaf5bc657069b2b
-
SHA1
f199c0094d2a20a8495d1efaeae841b50333a136
-
SHA256
8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287
-
SHA512
2b9ca3f1a5be8d965636f73bcd9b8bbe80394377490dd2401db69cf93f18cb1fb04f70c92249c76fcaef4b84eefeb784d4ec8806206f9d449ad51f766c4b518c
-
SSDEEP
24576:fcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:f5QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 320 8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe"C:\Users\Admin\AppData\Local\Temp\8597e951db8214e0de32fc28d8fb9148f8f0b2b3b46ee70e6b7daa25268d0287.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
738KB
MD5c89b75c6eef975d1c000178e53536033
SHA18b969c1801448f1def5853cef1a317dc690c1e6b
SHA25663e23a4c6fc647e50ce5e391609a87b88b04a6d643234df29a745a957baa7feb
SHA512b219d6687ba2e8ea9795be9f5cdc3bbc415082d27dd4499e813ffc87fc75783ce0d8df92053b0fb9716366b60b91109f6460cd7ceeaa58e5fb47cd7eae588002