Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 05:07
Behavioral task
behavioral1
Sample
SCREEN2EXE/Player.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
SCREEN2EXE/Player.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
SCREEN2EXE/Screen2Exe.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
SCREEN2EXE/Screen2Exe.exe
Resource
win10v2004-20240709-en
General
-
Target
SCREEN2EXE/Screen2Exe.exe
-
Size
318KB
-
MD5
c43b081ec855413d727462a12f3e2e5f
-
SHA1
93f6d89c1f59be4de315a3918a452d3a039152d0
-
SHA256
dec63e0c0bd0c9bbb08592df0e2caac4984ab05c3842a2c8d04b41baaead5a1b
-
SHA512
ac6562383ab94f28354aef234c8cb5becc945ca6a8b7705f6d44406c8c7a6df07d0dc118e4004dd888462fc7df1fb58f3d21f649042ca01e36f6aef1bccd7206
-
SSDEEP
6144:6CNCnS2D677X3DwW8z5P1i2IpGrbLR4EbKPacPrMCv1FS:6SCS2uDAPYpG314eZurxvzS
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4064 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4064 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2176 Screen2Exe.exe 2176 Screen2Exe.exe 2176 Screen2Exe.exe 2176 Screen2Exe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCREEN2EXE\Screen2Exe.exe"C:\Users\Admin\AppData\Local\Temp\SCREEN2EXE\Screen2Exe.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2176
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c 0x4541⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064