Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/08/2024, 14:08
240808-rfx2zayake 408/08/2024, 14:06
240808-reqw9svaqj 308/08/2024, 14:03
240808-rc4eksxhpc 4Analysis
-
max time kernel
72s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Void server boost/void server boost.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
Void server boost/void server boost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
General
-
Target
Void server boost/void server boost.exe
-
Size
1.0MB
-
MD5
ce1c66fbc99abd29ad81c5d064e0f966
-
SHA1
72394086d1916da3697e8513672e09f59a1ff907
-
SHA256
a18628e8080b21bf266abf4f571063abba2207ac2d999993541a0f49176b4801
-
SHA512
fca61fcb62742b33b46f7d6e73bcb6f0d841f7b96845e0578a36541945e7ada2eeefc812d698093935aa0809518178f764e0d04bcf889031abea4fd1f0f9621a
-
SSDEEP
24576:njih34xvK2EW2rLZHSIa6agTRpnnJMOr2I7cimoi1Cu:nO34xyD9L9LagThXr2+Vm
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1276 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵PID:2608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵PID:2884