Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/10/2024, 08:50
Behavioral task
behavioral1
Sample
639e6bb08e1fcefc214238bdab212db5.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
639e6bb08e1fcefc214238bdab212db5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
639e6bb08e1fcefc214238bdab212db5.exe
-
Size
3.3MB
-
MD5
639e6bb08e1fcefc214238bdab212db5
-
SHA1
90ed50bfb40a0c39cfed31333316f1aeed93b6e6
-
SHA256
d4bcad5d980510d16c37d90391196e0d06706b293fdc102c80f8e791ecece738
-
SHA512
acd434dd51ee9450cedc8d9d842dc278022e9242b1b1eafb67e60cc9e5e9309adf11f53e3e168bfbfbc9a427d23c84258fb7e4632563aac1dbeee492c4a935a1
-
SSDEEP
49152:UX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qx:UlRsZ47/QXoHUOfAoj1x6x
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1692 wmic.exe Token: SeSecurityPrivilege 1692 wmic.exe Token: SeTakeOwnershipPrivilege 1692 wmic.exe Token: SeLoadDriverPrivilege 1692 wmic.exe Token: SeSystemProfilePrivilege 1692 wmic.exe Token: SeSystemtimePrivilege 1692 wmic.exe Token: SeProfSingleProcessPrivilege 1692 wmic.exe Token: SeIncBasePriorityPrivilege 1692 wmic.exe Token: SeCreatePagefilePrivilege 1692 wmic.exe Token: SeBackupPrivilege 1692 wmic.exe Token: SeRestorePrivilege 1692 wmic.exe Token: SeShutdownPrivilege 1692 wmic.exe Token: SeDebugPrivilege 1692 wmic.exe Token: SeSystemEnvironmentPrivilege 1692 wmic.exe Token: SeRemoteShutdownPrivilege 1692 wmic.exe Token: SeUndockPrivilege 1692 wmic.exe Token: SeManageVolumePrivilege 1692 wmic.exe Token: 33 1692 wmic.exe Token: 34 1692 wmic.exe Token: 35 1692 wmic.exe Token: SeIncreaseQuotaPrivilege 1692 wmic.exe Token: SeSecurityPrivilege 1692 wmic.exe Token: SeTakeOwnershipPrivilege 1692 wmic.exe Token: SeLoadDriverPrivilege 1692 wmic.exe Token: SeSystemProfilePrivilege 1692 wmic.exe Token: SeSystemtimePrivilege 1692 wmic.exe Token: SeProfSingleProcessPrivilege 1692 wmic.exe Token: SeIncBasePriorityPrivilege 1692 wmic.exe Token: SeCreatePagefilePrivilege 1692 wmic.exe Token: SeBackupPrivilege 1692 wmic.exe Token: SeRestorePrivilege 1692 wmic.exe Token: SeShutdownPrivilege 1692 wmic.exe Token: SeDebugPrivilege 1692 wmic.exe Token: SeSystemEnvironmentPrivilege 1692 wmic.exe Token: SeRemoteShutdownPrivilege 1692 wmic.exe Token: SeUndockPrivilege 1692 wmic.exe Token: SeManageVolumePrivilege 1692 wmic.exe Token: 33 1692 wmic.exe Token: 34 1692 wmic.exe Token: 35 1692 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1692 2528 639e6bb08e1fcefc214238bdab212db5.exe 31 PID 2528 wrote to memory of 1692 2528 639e6bb08e1fcefc214238bdab212db5.exe 31 PID 2528 wrote to memory of 1692 2528 639e6bb08e1fcefc214238bdab212db5.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\639e6bb08e1fcefc214238bdab212db5.exe"C:\Users\Admin\AppData\Local\Temp\639e6bb08e1fcefc214238bdab212db5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692
-