Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
upgrade.exe
Resource
win10-20240404-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
upgrade.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
upgrade.exe
Resource
win11-20240709-en
2 signatures
150 seconds
General
-
Target
upgrade.exe
-
Size
13KB
-
MD5
fd4bf565af2154c5651a5d34bf993660
-
SHA1
4419971b7bf4fd32393707a5c18c66b19ffb46a0
-
SHA256
d0ec7df89e17c336e054aeb8dc433226fceff8dfc7d35f4f56dec398a6c1677e
-
SHA512
7b2c652f9d30cb434c57d11394e9d5c8267e923d2e3277ba643ae4560e7784eadee1911a6e2f9dd572cb812ed5924d0e61636ada2cb821b2e639a664da89d9f8
-
SSDEEP
192:MyM3mQn/knz2JA4GbfXi/VUktqq/Fb+pkVwpzRNca4a:MyM2Qn9C4GbfuVDqq1+Gw1Qa4
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 raw.githubusercontent.com 9 raw.githubusercontent.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3184 upgrade.exe