Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
bd276136/Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bd276136/Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe
Resource
win10v2004-20240226-en
General
-
Target
bd276136/Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe
-
Size
1.3MB
-
MD5
5c54912302b6243372e3614c1dc1cfd0
-
SHA1
91e631c21124822cb556be1657fc59df63a871a4
-
SHA256
495274f3bf971a82a6bddfbcf6385fa817cb303db5e8d64a363386193bae938a
-
SHA512
e74122606ab247f37d7d58779d9d7d531820be83449df1568406d2998969fddeaea34f6a9c8f3b608e3a7805cc3e80f4359fbf6b60f5ec588b7bf95672e3bc9f
-
SSDEEP
24576:x9fLuEYK0YYIfWf9EbqRHnzyNgQEIbCRCyQCCqYYxDSxtaC:7gKFZK9JRfQEBCgCqGa
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2168 Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2168 Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2168 wrote to memory of 1364 2168 Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe 28 PID 2168 wrote to memory of 1364 2168 Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe 28 PID 2168 wrote to memory of 1364 2168 Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd276136\Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe"C:\Users\Admin\AppData\Local\Temp\bd276136\Terraria v1.4-v1.4.1.2 Plus 12 Trainer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2168 -s 8402⤵PID:1364
-