Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 11:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Windows Update.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
binaryconvert.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
boot666.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
300 seconds
General
-
Target
Windows Update.exe
-
Size
9.0MB
-
MD5
83f4586de2ada8daa6fad9fdc57ba6aa
-
SHA1
566eb15119f1d2d471d33362b01802ad05f6376a
-
SHA256
b8bf7f6ad6486d39ba39c09169e9bd9740fbda852e670fcaf5bf5cb5f3fc4a49
-
SHA512
4ee3fa8934f8ea2075219943547efb9a4f77ae338e093d90236d9bb07b2e84392cba7b93ed7d94254dfd47d5cd584c4bd5c968d825ae1c0806996c29abf1d694
-
SSDEEP
196608:A66tn2+geSaA9+1wr9NGRGja3/aTLM89wXVM0rlhPekq/IdT+7:IZgjaA41wKKayfM8oK8lZleIdTk
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: Windows Update.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2824 taskmgr.exe 3012 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2824 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"C:\Users\Admin\AppData\Local\Temp\Windows Update.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
PID:3012
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824