Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48ea9e8bb1b1e792f37d2611c7eb8740.exe
Resource
win7-20231020-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
48ea9e8bb1b1e792f37d2611c7eb8740.exe
Resource
win10v2004-20231023-en
4 signatures
150 seconds
General
-
Target
48ea9e8bb1b1e792f37d2611c7eb8740.exe
-
Size
701KB
-
MD5
48ea9e8bb1b1e792f37d2611c7eb8740
-
SHA1
c13b165267edf53b67dd463205ebb97827080dcd
-
SHA256
c0a6b6487b789fcb37201d80e23aeaf843d09864f593f0f0d74d240bc30d1346
-
SHA512
43b79976b78d219cd8503cfd8164d00da5e4b904054d9acc2a2c25037efc1fbdd726092f0a4532dbdb0d906d8f19d06de26e31023e2ddadf7775b619fa02b14b
-
SSDEEP
12288:FytbV3kSoXaLnJoslyz4x1wtrWgvKGNxJ9UXSk8AmosSo:Eb5kSYaLJVlyz4xQrW58JON8A1K
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2216 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2644 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2516 48ea9e8bb1b1e792f37d2611c7eb8740.exe 2516 48ea9e8bb1b1e792f37d2611c7eb8740.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2516 48ea9e8bb1b1e792f37d2611c7eb8740.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2216 2516 48ea9e8bb1b1e792f37d2611c7eb8740.exe 28 PID 2516 wrote to memory of 2216 2516 48ea9e8bb1b1e792f37d2611c7eb8740.exe 28 PID 2516 wrote to memory of 2216 2516 48ea9e8bb1b1e792f37d2611c7eb8740.exe 28 PID 2216 wrote to memory of 2644 2216 cmd.exe 30 PID 2216 wrote to memory of 2644 2216 cmd.exe 30 PID 2216 wrote to memory of 2644 2216 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\48ea9e8bb1b1e792f37d2611c7eb8740.exe"C:\Users\Admin\AppData\Local\Temp\48ea9e8bb1b1e792f37d2611c7eb8740.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\48ea9e8bb1b1e792f37d2611c7eb8740.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2644
-
-