Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
114323724b8d973bed5695c8cb9cd99d.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
114323724b8d973bed5695c8cb9cd99d.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
114323724b8d973bed5695c8cb9cd99d.exe
-
Size
461KB
-
MD5
114323724b8d973bed5695c8cb9cd99d
-
SHA1
15c0d7bc0606a5d1130ad695a57f3f7929eb68a5
-
SHA256
615bf54dd4d85ba640db0763992d41361b0b68c389b496ca9f45b1edc4abe742
-
SHA512
3c65ae089b41b26d287802a8e86c653be4a6dd65246361890277e5d126e256c66c33439d8dd45c0f7116054fca46e6a66920b1373c0949063c6e9fbceeb67179
-
SSDEEP
6144:6oakgWv8LmllrvJQOwxW6XUrbV0O0T5jDTRGGzz5TBNU3Xi0Gs2xnCJgrE:6GgW+GzO/WwUrPWJlfzddNU3XBuCJgrE
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2624 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2828 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 780 wrote to memory of 2624 780 114323724b8d973bed5695c8cb9cd99d.exe 30 PID 780 wrote to memory of 2624 780 114323724b8d973bed5695c8cb9cd99d.exe 30 PID 780 wrote to memory of 2624 780 114323724b8d973bed5695c8cb9cd99d.exe 30 PID 780 wrote to memory of 2624 780 114323724b8d973bed5695c8cb9cd99d.exe 30 PID 2624 wrote to memory of 2828 2624 cmd.exe 32 PID 2624 wrote to memory of 2828 2624 cmd.exe 32 PID 2624 wrote to memory of 2828 2624 cmd.exe 32 PID 2624 wrote to memory of 2828 2624 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\114323724b8d973bed5695c8cb9cd99d.exe"C:\Users\Admin\AppData\Local\Temp\114323724b8d973bed5695c8cb9cd99d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\114323724b8d973bed5695c8cb9cd99d.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2828
-
-