Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a13693d23cec2423d563fb73ba8396b.exe
Resource
win7-20231129-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a13693d23cec2423d563fb73ba8396b.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
0a13693d23cec2423d563fb73ba8396b.exe
-
Size
488KB
-
MD5
0a13693d23cec2423d563fb73ba8396b
-
SHA1
aea530cdac019cd949470898d914b16cca37b9e0
-
SHA256
2548d7f66f43baff8d30dab169bcb6b8a4da6310b1a4512fa31551d56b73b506
-
SHA512
7bb15869e537d0cbfd7c5879c85fe848d7b4fb5e3d807100d29ce3d0a20e12b36a6b7f7719773105cb2ab5c1cc8b7ffb1a9ac96db57e6d064cc954d94494e5b4
-
SSDEEP
12288:FytbV3kSoXaLnTosl0CwYQ+TY0kyrEGZm/:Eb5kSYaLTVl0C9Q+TYQhK
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3892 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 444 0a13693d23cec2423d563fb73ba8396b.exe 444 0a13693d23cec2423d563fb73ba8396b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 444 0a13693d23cec2423d563fb73ba8396b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 444 wrote to memory of 2196 444 0a13693d23cec2423d563fb73ba8396b.exe 20 PID 444 wrote to memory of 2196 444 0a13693d23cec2423d563fb73ba8396b.exe 20 PID 2196 wrote to memory of 3892 2196 cmd.exe 16 PID 2196 wrote to memory of 3892 2196 cmd.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a13693d23cec2423d563fb73ba8396b.exe"C:\Users\Admin\AppData\Local\Temp\0a13693d23cec2423d563fb73ba8396b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\0a13693d23cec2423d563fb73ba8396b.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2196
-
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60001⤵
- Runs ping.exe
PID:3892