Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe
Resource
win10v2004-20221111-en
General
-
Target
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe
-
Size
44KB
-
MD5
191c37c882bc1e5e8f55b8251ad91f6e
-
SHA1
af92d3b778c24635942b15dd0a345b8dc4014639
-
SHA256
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391
-
SHA512
42e9b74116096be694590848d6117a7e7991e4f62c2177c45be4860024ffb3da5db2dae729e77ce770d096c8738ce7812bb19a56becea136e4d020e6133de162
-
SSDEEP
384:y2TwWZOcgXjEhvVRl08TIQq+IEXDFn/EC+9TR4y7r2XR5Co8xE+EtrnEnqQiRW6d:y2TwFcgXon/TFe9TuGSeo86X2qQ4m2E
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1952 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1860 PING.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 364 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 364 wrote to memory of 1952 364 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 26 PID 364 wrote to memory of 1952 364 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 26 PID 364 wrote to memory of 1952 364 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 26 PID 364 wrote to memory of 1952 364 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 26 PID 1952 wrote to memory of 1860 1952 cmd.exe 28 PID 1952 wrote to memory of 1860 1952 cmd.exe 28 PID 1952 wrote to memory of 1860 1952 cmd.exe 28 PID 1952 wrote to memory of 1860 1952 cmd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe"C:\Users\Admin\AppData\Local\Temp\e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ping 127.1 -n 3 >nul 2>nul >c:\c.bat&echo del "C:\Users\Admin\AppData\Local\Temp\e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe">>c:\c.bat&echo del c:\c.bat>>c:\c.bat&c:\c.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\PING.EXEping 127.1 -n 33⤵
- Runs ping.exe
PID:1860
-
-