Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 13:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ProcessStealth.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ProcessStealth.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ProcessStealth.exe
-
Size
60KB
-
MD5
8dd3f6b32f9f7cd335c90439ba34ea2e
-
SHA1
f0567a5331efd8ba685bfd1a56f56868198382ca
-
SHA256
211aa8f15a37e6d2244b4a9b2d1c5494b9826f0cc469372873659485ec1087a5
-
SHA512
c8416415552cc7d89b770a1305d56289ef1f1b1c7f4852ea7d1dd81697fc681f8b175cfe915804b0ad2faeb30195b0cae2cb3dcbdc5e413faae7e12e97e9f33f
-
SSDEEP
768:n4NdQTHZPkKaYOlkfEqTIYv4gKNwFPFceMpaSIhkqe7+JD:nodiTEqTIm4gKN2PFNYaBEED
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2112 ProcessStealth.exe 2112 ProcessStealth.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1768 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe 1768 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1200 2112 ProcessStealth.exe 29 PID 2112 wrote to memory of 1200 2112 ProcessStealth.exe 29 PID 2112 wrote to memory of 1200 2112 ProcessStealth.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProcessStealth.exe"C:\Users\Admin\AppData\Local\Temp\ProcessStealth.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:1200
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1768