Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48ea9e8bb1b1e792f37d2611c7eb8740.exe
Resource
win7-20231020-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
48ea9e8bb1b1e792f37d2611c7eb8740.exe
Resource
win10v2004-20231023-en
4 signatures
150 seconds
General
-
Target
48ea9e8bb1b1e792f37d2611c7eb8740.exe
-
Size
701KB
-
MD5
48ea9e8bb1b1e792f37d2611c7eb8740
-
SHA1
c13b165267edf53b67dd463205ebb97827080dcd
-
SHA256
c0a6b6487b789fcb37201d80e23aeaf843d09864f593f0f0d74d240bc30d1346
-
SHA512
43b79976b78d219cd8503cfd8164d00da5e4b904054d9acc2a2c25037efc1fbdd726092f0a4532dbdb0d906d8f19d06de26e31023e2ddadf7775b619fa02b14b
-
SSDEEP
12288:FytbV3kSoXaLnJoslyz4x1wtrWgvKGNxJ9UXSk8AmosSo:Eb5kSYaLJVlyz4xQrW58JON8A1K
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2548 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 48ea9e8bb1b1e792f37d2611c7eb8740.exe 3988 48ea9e8bb1b1e792f37d2611c7eb8740.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3988 48ea9e8bb1b1e792f37d2611c7eb8740.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3988 wrote to memory of 3400 3988 48ea9e8bb1b1e792f37d2611c7eb8740.exe 84 PID 3988 wrote to memory of 3400 3988 48ea9e8bb1b1e792f37d2611c7eb8740.exe 84 PID 3400 wrote to memory of 2548 3400 cmd.exe 86 PID 3400 wrote to memory of 2548 3400 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\48ea9e8bb1b1e792f37d2611c7eb8740.exe"C:\Users\Admin\AppData\Local\Temp\48ea9e8bb1b1e792f37d2611c7eb8740.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\48ea9e8bb1b1e792f37d2611c7eb8740.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2548
-
-