Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/12/2024, 00:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
Resource
win7-20240708-en
3 signatures
120 seconds
General
-
Target
4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe
-
Size
17KB
-
MD5
5fc925dccc87a017afdeb282abcd15c0
-
SHA1
37490c3d629bc7081082aca0422d2c45ed0520d3
-
SHA256
4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7
-
SHA512
6ce7ba920269c04ce52b39aae684ed6f70b7bec238c6098e47c64f9fc0a8712a0958faa546a59a207535a8dcd797594f5404a0766a3ce32cb59005e0513571e7
-
SSDEEP
384:kEGfInKqgn7PiAniAAAeXWLMN8GuTM0sg7UAmm6+5qZMXBNTV76fA:kZfyU76AniAAAdJsCDXBNTpP
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1380 wrote to memory of 2344 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 30 PID 1380 wrote to memory of 2344 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 30 PID 1380 wrote to memory of 2344 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 30 PID 1380 wrote to memory of 2344 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 30 PID 1380 wrote to memory of 2404 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 31 PID 1380 wrote to memory of 2404 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 31 PID 1380 wrote to memory of 2404 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 31 PID 1380 wrote to memory of 2404 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 31 PID 1380 wrote to memory of 1964 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 32 PID 1380 wrote to memory of 1964 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 32 PID 1380 wrote to memory of 1964 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 32 PID 1380 wrote to memory of 1964 1380 4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe"C:\Users\Admin\AppData\Local\Temp\4ce3ee1e160287a00f1fa47cac445eecc40e4193532c798df5b11a00b1833fc7N.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2344
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:1964
-