Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sims4PacksFree.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Sims4PacksFree.exe
-
Size
838KB
-
MD5
2f07889d02eb19135396836273acc2cf
-
SHA1
2c39c211696ea7843f551d92ed3833b8e0b74278
-
SHA256
cf7bc065b5119e43722b2316fa8035283a3b958e4736607f323e7f8c13a2119a
-
SHA512
9e949f5d8b773ebd72a7153e5b284d94709cf0dd1b5ca263bb819d0b12de3c15adfd09d033997f07ef3cf300ef5794275bf3e69f0320389f2799b1494a9d3369
-
SSDEEP
24576:NEW8odvocoQ9i816JzYoJ/8aooznCpzNA3/F:FZ9obSQYE8ozIS3
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sims4PacksFree.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sims4PacksFree.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sims4PacksFree.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sims4PacksFree.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2808 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2808 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3052
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"1⤵
- System Location Discovery: System Language Discovery
PID:380
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2808
-
C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2596
-
C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"C:\Users\Admin\AppData\Local\Temp\Sims4PacksFree.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2924