Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 23:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AtDeadOfNight.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
AtDeadOfNight.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
AtDeadOfNight.exe
-
Size
1.9MB
-
MD5
c15e673336dd7154a38a60c21ed299de
-
SHA1
bd14e46b26bcf7fc0d7c13b5cfc6b9288a1492c7
-
SHA256
5751b4d22f14ad163451e3a731d86db6f3272784162c4a5f825d38137e191e8d
-
SHA512
26cabfbda6bacc9f255358dc724ee06e94e143972efb278cc2edee9dc69c4c6ab2ee3958e7ce91c553ffb86baf3d67e9ff75c0dc0b22a974dbac9a32415ce2f0
-
SSDEEP
24576:EIvdc+HystDhsCdfnjdagO7Hjll0Ipq9L21Vva8XYVOj4FJAHToEK/dX:EmPHystHBnjdagWBfYq1VvakTj6oT
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2632 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AtDeadOfNight.exe"C:\Users\Admin\AppData\Local\Temp\AtDeadOfNight.exe"1⤵PID:2068
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2632