Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe
Resource
win10v2004-20240704-en
General
-
Target
d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe
-
Size
3.1MB
-
MD5
e1b9fdffad9196c090fc3e75b6897d31
-
SHA1
3110c34ea86ea1c973cde1db88034812f4339edd
-
SHA256
d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa
-
SHA512
036050247aae1a33b559233bc09bfb3aeb32abbc2b73a0a55679366edb266c01765250a597dd8b3c3d40c62c9978270f424c83152485dc64f11098bce70d31cd
-
SSDEEP
49152:CaLKuzj8Hv+XM9wqtQ2GSWdcK9v+XM9wqt6SWe2fJ0st0zw:YU2BK9t2f
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1544 d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1544 d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1544 d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe"C:\Users\Admin\AppData\Local\Temp\d83a5eef98c03ab3d2660f9edf481cd5912d457a0c3921fcf49c8aa9182eb8fa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1544