Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
1dec33916cd43fca485be9e4b64c64f5.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1dec33916cd43fca485be9e4b64c64f5.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
1dec33916cd43fca485be9e4b64c64f5.exe
-
Size
374KB
-
MD5
1dec33916cd43fca485be9e4b64c64f5
-
SHA1
4ab35c8c3be544b58bb25f006714682612a9874f
-
SHA256
14c2ca3fcf019dc44cdac2f4a9bc4cfdc5440ad85f91b9ae033f149ddf95a976
-
SHA512
ef6bea083481a4825a89b5d6f9cc51514ce8105e344d789a6aa4c369e6b0f255137bdb2962e2bb8cf05e20c823444cc27bdc4e30c465ab05d2eecbecf1c11f2f
-
SSDEEP
6144:cazxDXDxEA4wqbtUxvJdvwDkf8A0QgEnH+9YnXx4TkZNpgL064UPx3M:cixEALqbtU/d44CEe9yXuTkZS0kM
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3652 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1616 wrote to memory of 3684 1616 1dec33916cd43fca485be9e4b64c64f5.exe 93 PID 1616 wrote to memory of 3684 1616 1dec33916cd43fca485be9e4b64c64f5.exe 93 PID 1616 wrote to memory of 3684 1616 1dec33916cd43fca485be9e4b64c64f5.exe 93 PID 3684 wrote to memory of 3652 3684 cmd.exe 94 PID 3684 wrote to memory of 3652 3684 cmd.exe 94 PID 3684 wrote to memory of 3652 3684 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dec33916cd43fca485be9e4b64c64f5.exe"C:\Users\Admin\AppData\Local\Temp\1dec33916cd43fca485be9e4b64c64f5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1dec33916cd43fca485be9e4b64c64f5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:3652
-
-