Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 00:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0920113eb017459cc13ced85b986e6fb.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0920113eb017459cc13ced85b986e6fb.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
0920113eb017459cc13ced85b986e6fb.exe
-
Size
488KB
-
MD5
0920113eb017459cc13ced85b986e6fb
-
SHA1
92be36f319cdcb568040ac3d862eef3c8da7dc3d
-
SHA256
809bc3a0b665d5f765bb4469c1a5e1c18ca47ef4462fb5107526f75d679b6911
-
SHA512
b2d339e8bd3b67add8f1a1934aed829783ffee40d029f1c20e57dd9add162709d9667131440df0b2c8426b1339744fbf3a5e93cdaefc840f9063de4f3b71f994
-
SSDEEP
12288:FytbV3kSoXaLnToslfkwgvOnN2hyGx/AE3WdIra0:Eb5kSYaLTVlfRNMysNWia0
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1660 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3468 0920113eb017459cc13ced85b986e6fb.exe 3468 0920113eb017459cc13ced85b986e6fb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3468 0920113eb017459cc13ced85b986e6fb.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3468 wrote to memory of 408 3468 0920113eb017459cc13ced85b986e6fb.exe 88 PID 3468 wrote to memory of 408 3468 0920113eb017459cc13ced85b986e6fb.exe 88 PID 408 wrote to memory of 1660 408 cmd.exe 90 PID 408 wrote to memory of 1660 408 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0920113eb017459cc13ced85b986e6fb.exe"C:\Users\Admin\AppData\Local\Temp\0920113eb017459cc13ced85b986e6fb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\0920113eb017459cc13ced85b986e6fb.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:1660
-
-