Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
Resource
win10v2004-20220812-en
General
-
Target
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
-
Size
157KB
-
MD5
7d1ed080cf48dc127655f0edc91450e1
-
SHA1
67735ea2edc526b053a0055b59bc46224f4cf2e1
-
SHA256
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84
-
SHA512
10aa22227c78eb854937a1486857ebe6930f9377c5d15456dff611dd1c8be1a9e784928918b6897ef0a911e6dccae70cc149964f7cfb8d11310046ec49bf0c8c
-
SSDEEP
3072:ladYAFNbRRNliiJ8kGTkQv/pOmo4FyqwgCyKY8Xb8Y+o/:l9A3trliiieIRO5mVYn
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1292 PING.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4164 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 4164 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4164 wrote to memory of 228 4164 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 84 PID 4164 wrote to memory of 228 4164 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 84 PID 4164 wrote to memory of 228 4164 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 84 PID 228 wrote to memory of 1292 228 cmd.exe 86 PID 228 wrote to memory of 1292 228 cmd.exe 86 PID 228 wrote to memory of 1292 228 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe"C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.execmd.exe /e:on /d /c ping -n 6 127.0.0.1 && DEL /F "C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe" >> nul2⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\PING.EXEping -n 6 127.0.0.13⤵
- Runs ping.exe
PID:1292
-
-