Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
16942c4618eb1211b0e9b8fa4621033c.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
16942c4618eb1211b0e9b8fa4621033c.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
16942c4618eb1211b0e9b8fa4621033c.exe
-
Size
465KB
-
MD5
16942c4618eb1211b0e9b8fa4621033c
-
SHA1
6fd7a7b3b493e27a86c40fcf7e81f88fc033ad5a
-
SHA256
a75b813858ae43f1ebde351bbdc24fe60981389ab4e789e0af082472483741b0
-
SHA512
6454ef325d4976087cbe52fb08c0b5d04b12b7a0d8002b8ba88cd1f75cb206a419733f62f698f5fe33453b6935cbedf264eba4d2c579815140a0a5ae8de901c5
-
SSDEEP
6144:iK0eY9v/66ESieaLK4DtDqPvJPss6hz107Xa9G3K3sK4bgam+xp6N8THm:MXmX64DtEqrx07XcGisHm+Bzm
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2776 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2572 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2776 2056 16942c4618eb1211b0e9b8fa4621033c.exe 31 PID 2056 wrote to memory of 2776 2056 16942c4618eb1211b0e9b8fa4621033c.exe 31 PID 2056 wrote to memory of 2776 2056 16942c4618eb1211b0e9b8fa4621033c.exe 31 PID 2056 wrote to memory of 2776 2056 16942c4618eb1211b0e9b8fa4621033c.exe 31 PID 2776 wrote to memory of 2572 2776 cmd.exe 33 PID 2776 wrote to memory of 2572 2776 cmd.exe 33 PID 2776 wrote to memory of 2572 2776 cmd.exe 33 PID 2776 wrote to memory of 2572 2776 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\16942c4618eb1211b0e9b8fa4621033c.exe"C:\Users\Admin\AppData\Local\Temp\16942c4618eb1211b0e9b8fa4621033c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\16942c4618eb1211b0e9b8fa4621033c.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2572
-
-