Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mtk_bypass_rev4.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
General
-
Target
mtk_bypass_rev4.exe
-
Size
12.2MB
-
MD5
eb21b4503292a78fb468b7058f4a297e
-
SHA1
bff15878980b289aedd3811e4d1374a7c5fd6503
-
SHA256
001b2dfac98fa69fb8bc402a510a99f2b5a617acadaa59cc9a2ab50264c04dec
-
SHA512
fb4e1b7cd688ce1f445677442a0d6dc57c253289c4980801260c718b2f4878b64d3bb7fded89d564b836b2722dd1897012008c9fc36285548d580bf25e7d3f02
-
SSDEEP
196608:aHI4e4brzsBNVS3/wrPJZ5Nz3EouuhQpGIjoEARm0BD93BVqJomutFHM7ACsabs:aHXLsBDTLvTUOKzjkTjmSsM7ys
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2632 taskmgr.exe Token: 33 2528 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2528 AUDIODG.EXE Token: 33 2528 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2528 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe 2632 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mtk_bypass_rev4.exe"C:\Users\Admin\AppData\Local\Temp\mtk_bypass_rev4.exe"1⤵PID:2444
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2632
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2504
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5181⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528