Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cad39b8665d547f24e7155b856862fe0N.exe
Resource
win7-20240903-en
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
cad39b8665d547f24e7155b856862fe0N.exe
Resource
win10v2004-20240802-en
5 signatures
120 seconds
General
-
Target
cad39b8665d547f24e7155b856862fe0N.exe
-
Size
41KB
-
MD5
cad39b8665d547f24e7155b856862fe0
-
SHA1
fbd2b09bad5eb7ec86afe5d0d72d2fefdfa7b42b
-
SHA256
69324e3eda4b071d11009e0dd6073710ea56e5b90125316b280ce77dcd0b014f
-
SHA512
d76f467ad38d3a9a5e8df08d0a366ca72aa2213e0a9df30d058c1ce0e1142c7fc08c76ff22f93bf3e70be84e9689ab72483b5d53a07198b687e58ea860643036
-
SSDEEP
768:DD7ouB15GZcHnyhHJIYo8ixhVHRmHRUuY:h1ASnHYo82hVHiX
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2748 cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious behavior: MapViewOfSection 24 IoCs
pid Process 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe 2748 cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2748 cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 380 2748 cad39b8665d547f24e7155b856862fe0N.exe 3 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 396 2748 cad39b8665d547f24e7155b856862fe0N.exe 4 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 432 2748 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 476 2748 cad39b8665d547f24e7155b856862fe0N.exe 6 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 492 2748 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 500 2748 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 608 2748 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 680 2748 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 760 2748 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 2748 wrote to memory of 824 2748 cad39b8665d547f24e7155b856862fe0N.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1560
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1696
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:760
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:296
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1076
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1120
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:852
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2388
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1760
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\cad39b8665d547f24e7155b856862fe0N.exe"C:\Users\Admin\AppData\Local\Temp\cad39b8665d547f24e7155b856862fe0N.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
-