Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 11:13
Static task
static1
Behavioral task
behavioral1
Sample
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe
Resource
win10v2004-20221111-en
General
-
Target
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe
-
Size
44KB
-
MD5
191c37c882bc1e5e8f55b8251ad91f6e
-
SHA1
af92d3b778c24635942b15dd0a345b8dc4014639
-
SHA256
e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391
-
SHA512
42e9b74116096be694590848d6117a7e7991e4f62c2177c45be4860024ffb3da5db2dae729e77ce770d096c8738ce7812bb19a56becea136e4d020e6133de162
-
SSDEEP
384:y2TwWZOcgXjEhvVRl08TIQq+IEXDFn/EC+9TR4y7r2XR5Co8xE+EtrnEnqQiRW6d:y2TwFcgXon/TFe9TuGSeo86X2qQ4m2E
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3200 PING.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 912 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 912 wrote to memory of 3052 912 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 82 PID 912 wrote to memory of 3052 912 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 82 PID 912 wrote to memory of 3052 912 e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe 82 PID 3052 wrote to memory of 3200 3052 cmd.exe 84 PID 3052 wrote to memory of 3200 3052 cmd.exe 84 PID 3052 wrote to memory of 3200 3052 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe"C:\Users\Admin\AppData\Local\Temp\e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ping 127.1 -n 3 >nul 2>nul >c:\c.bat&echo del "C:\Users\Admin\AppData\Local\Temp\e61557848fdf71e1b5afed50662a04e177ee7263160c9c30dff7de56cac9b391.exe">>c:\c.bat&echo del c:\c.bat>>c:\c.bat&c:\c.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\PING.EXEping 127.1 -n 33⤵
- Runs ping.exe
PID:3200
-
-