Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/06/2024, 14:26
240606-rr1x1agc93 706/06/2024, 14:23
240606-rqb79agc63 706/06/2024, 14:19
240606-rm83tafc5s 7Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
06/06/2024, 14:26
General
-
Target
Spark Clicker.exe
-
Size
6.1MB
-
MD5
1eb8146f8c8a9faee483039585347ce0
-
SHA1
f98fd066d30658c35d5abdb2432f3adff142b813
-
SHA256
55397cfeea42a91fbae9e11a2365501df943175e2df5b2ffe6505cbf51f0798b
-
SHA512
b0605500bc835773cd621c973580873f301ae752c7319f08fb3ce4f1d3a05ff1ce748b86c9ac60abfaf930ab12ca48b0e100492e0020e763ba565fb8b6add304
-
SSDEEP
98304:pY0lYn54JO2GS/eX/cc7m2eUZmepnzPuMStE1HI0+gtr9jTA3k7kvH:mPaJkQc7feUFLuMr1t+cZuH
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spark Clicker.exe"C:\Users\Admin\AppData\Local\Temp\Spark Clicker.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
11.5MB
-
Filesize
8KB
-
Filesize
11.5MB
-
Filesize
3.9MB
-
Filesize
11.5MB