Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
3dc3139508d643311b91414be61cba31.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3dc3139508d643311b91414be61cba31.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
3dc3139508d643311b91414be61cba31.exe
-
Size
397KB
-
MD5
3dc3139508d643311b91414be61cba31
-
SHA1
99acad3932d33fc1769d62687b18f6786b7b9ce6
-
SHA256
23bbc3a59519aad95c96c3ae9eebd9af508a68f126c9279a4b0841e737596df9
-
SHA512
54ba5e8acac861f65c1fbd65dd3c22840fb9e66d2a8a2f62764919d6b8df3b35b0af2248bd8257879cd69087bc8d5669207c52ab014a34863fe0041481c7e2b5
-
SSDEEP
6144:tfvbnL+DGVJPqm6WpM0Xzn7mMa9pRxrrK483X1hE0LLKaQFk7swvdsruyd8Mv:R+DGnDz4xrrs97s/ruOv
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2720 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2980 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2720 2892 3dc3139508d643311b91414be61cba31.exe 32 PID 2892 wrote to memory of 2720 2892 3dc3139508d643311b91414be61cba31.exe 32 PID 2892 wrote to memory of 2720 2892 3dc3139508d643311b91414be61cba31.exe 32 PID 2892 wrote to memory of 2720 2892 3dc3139508d643311b91414be61cba31.exe 32 PID 2720 wrote to memory of 2980 2720 cmd.exe 30 PID 2720 wrote to memory of 2980 2720 cmd.exe 30 PID 2720 wrote to memory of 2980 2720 cmd.exe 30 PID 2720 wrote to memory of 2980 2720 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dc3139508d643311b91414be61cba31.exe"C:\Users\Admin\AppData\Local\Temp\3dc3139508d643311b91414be61cba31.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\3dc3139508d643311b91414be61cba31.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2720
-
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30001⤵
- Runs ping.exe
PID:2980