Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2022, 08:00
Static task
static1
Behavioral task
behavioral1
Sample
3550/3367.cmd
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3550/3367.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
3550/pots.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
3550/pots.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
New_documents.lnk
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
New_documents.lnk
Resource
win10v2004-20220812-en
General
-
Target
3550/3367.cmd
-
Size
245B
-
MD5
c0a2c18b8e80e4a7af74bf718bbb993b
-
SHA1
7c87ef36f1763b5d5234ca45445b73bb3f49b8b2
-
SHA256
6e67d68badb493c0be327073ff68740c6cca48de5094d925593dd1248f1046c1
-
SHA512
bd84b3ba94e30169d9b12e3f1363cdc9731a728ade2717a6ebdd9de23494c0441043304fd82ad3ddc8bbb627c882df17ebeb4985c3667b38c93de9773a16b1b2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3004 in.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 644 PING.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5032 wrote to memory of 644 5032 cmd.exe 81 PID 5032 wrote to memory of 644 5032 cmd.exe 81 PID 5032 wrote to memory of 3004 5032 cmd.exe 82 PID 5032 wrote to memory of 3004 5032 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3550\3367.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\PING.EXEping google.com2⤵
- Runs ping.exe
PID:644
-
-
C:\Users\Admin\AppData\Local\Temp\in.exeC:\Users\Admin\AppData\Local\Temp\\in.exe 3550\pots.dat2⤵
- Executes dropped EXE
PID:3004
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5b0c2fa35d14a9fad919e99d9d75e1b9e
SHA18d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA256022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
SHA512a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022