Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/05/2024, 02:06
240512-cjsjbsbe2w 412/05/2024, 02:06
240512-cjhn5abd9s 112/05/2024, 02:05
240512-cjazaabd8w 112/05/2024, 02:05
240512-ch5ghaed68 112/05/2024, 02:05
240512-chynysbd6w 112/05/2024, 02:04
240512-chqy4sbd5z 112/05/2024, 02:04
240512-chk3vsed49 1012/05/2024, 02:04
240512-che7lsed44 112/05/2024, 02:04
240512-cg84ased37 1Analysis
-
max time kernel
1190s -
max time network
847s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
screen-20240511-181029.mp4
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
screen-20240511-181029.mp4
Resource
win10v2004-20240508-en
General
-
Target
screen-20240511-181029.mp4
-
Size
12.8MB
-
MD5
8e479d8106be86a73f25c99ca4b8146f
-
SHA1
ecb2595bd8a69438c094d3d7abfe91e9a68965a8
-
SHA256
08ed3b69d0889e5b2cb54a2a1fb81a880c22931b05df8cfb71367905fc73607d
-
SHA512
3cbe45aebe435c9201b8f7918c2f95fde6c40fce642f2eb165f582ef9068a109aea7f2c1cf7d0b432b700a3858458f25897e84ae344e09e046e28c165d503124
-
SSDEEP
196608:d9lefzSHXZLvaUGZbDpKLQNEd4AahmdcnTKJqORRWitUtZhWM:darStvahblKLQo/ldcTdORRWuUX
Malware Config
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1956 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1956 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1956 vlc.exe Token: SeIncBasePriorityPrivilege 1956 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe 1956 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1956 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\screen-20240511-181029.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1956