Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
16942c4618eb1211b0e9b8fa4621033c.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
16942c4618eb1211b0e9b8fa4621033c.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
16942c4618eb1211b0e9b8fa4621033c.exe
-
Size
465KB
-
MD5
16942c4618eb1211b0e9b8fa4621033c
-
SHA1
6fd7a7b3b493e27a86c40fcf7e81f88fc033ad5a
-
SHA256
a75b813858ae43f1ebde351bbdc24fe60981389ab4e789e0af082472483741b0
-
SHA512
6454ef325d4976087cbe52fb08c0b5d04b12b7a0d8002b8ba88cd1f75cb206a419733f62f698f5fe33453b6935cbedf264eba4d2c579815140a0a5ae8de901c5
-
SSDEEP
6144:iK0eY9v/66ESieaLK4DtDqPvJPss6hz107Xa9G3K3sK4bgam+xp6N8THm:MXmX64DtEqrx07XcGisHm+Bzm
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 964 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4516 wrote to memory of 944 4516 16942c4618eb1211b0e9b8fa4621033c.exe 96 PID 4516 wrote to memory of 944 4516 16942c4618eb1211b0e9b8fa4621033c.exe 96 PID 4516 wrote to memory of 944 4516 16942c4618eb1211b0e9b8fa4621033c.exe 96 PID 944 wrote to memory of 964 944 cmd.exe 94 PID 944 wrote to memory of 964 944 cmd.exe 94 PID 944 wrote to memory of 964 944 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\16942c4618eb1211b0e9b8fa4621033c.exe"C:\Users\Admin\AppData\Local\Temp\16942c4618eb1211b0e9b8fa4621033c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\16942c4618eb1211b0e9b8fa4621033c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:944
-
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30001⤵
- Runs ping.exe
PID:964