Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ae1630cee784f0cab8e58ab2a35c01c.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ae1630cee784f0cab8e58ab2a35c01c.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
1ae1630cee784f0cab8e58ab2a35c01c.exe
-
Size
316KB
-
MD5
1ae1630cee784f0cab8e58ab2a35c01c
-
SHA1
e213b67d52cc092d2d24e0277af1b72ca0b3a292
-
SHA256
dfadd7c8e55b95578cdca3217b7d413f7ab21939e69498e974272d558c5ae416
-
SHA512
12cb8c611abdf079de268f51b3bf188c8f9a170dca36a9f791098c318eb25a03e04033479315ed62abb03645e83f998eaf20cbf05f585db329867281082c091e
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEoOK+H:FytbV3kSoXaLnToslVOK+H
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2964 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3888 1ae1630cee784f0cab8e58ab2a35c01c.exe 3888 1ae1630cee784f0cab8e58ab2a35c01c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3888 1ae1630cee784f0cab8e58ab2a35c01c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3888 wrote to memory of 5004 3888 1ae1630cee784f0cab8e58ab2a35c01c.exe 88 PID 3888 wrote to memory of 5004 3888 1ae1630cee784f0cab8e58ab2a35c01c.exe 88 PID 5004 wrote to memory of 2964 5004 cmd.exe 90 PID 5004 wrote to memory of 2964 5004 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae1630cee784f0cab8e58ab2a35c01c.exe"C:\Users\Admin\AppData\Local\Temp\1ae1630cee784f0cab8e58ab2a35c01c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1ae1630cee784f0cab8e58ab2a35c01c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2964
-
-