Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 11:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
177bea98bc7f1be882066b749f8ac547.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
177bea98bc7f1be882066b749f8ac547.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
177bea98bc7f1be882066b749f8ac547.exe
-
Size
488KB
-
MD5
177bea98bc7f1be882066b749f8ac547
-
SHA1
94b7e9e05ea79fc042c379e4d1b388eb23083d5b
-
SHA256
54d107fd8cb067ff034ad32c63171bf2201a94b6fe0f02eb1d168304b8699c71
-
SHA512
825bcd85ce3ff1cffb5a6ee691b26bc50ed8019c83c4742cea7557e1ccaae6d698cfc8d76600fdc2e0c9e75bfa77653ba1e827e414743d9a53d27c8a5e56134c
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE+BA5ADVVLqg+i+kwWX9Xv6F0OY2RPH7VK:FytbV3kSoXaLnToslvHDOvxWQCOF5PsV
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2500 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2008 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2516 177bea98bc7f1be882066b749f8ac547.exe 2516 177bea98bc7f1be882066b749f8ac547.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2516 177bea98bc7f1be882066b749f8ac547.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2500 2516 177bea98bc7f1be882066b749f8ac547.exe 18 PID 2516 wrote to memory of 2500 2516 177bea98bc7f1be882066b749f8ac547.exe 18 PID 2516 wrote to memory of 2500 2516 177bea98bc7f1be882066b749f8ac547.exe 18 PID 2500 wrote to memory of 2008 2500 cmd.exe 17 PID 2500 wrote to memory of 2008 2500 cmd.exe 17 PID 2500 wrote to memory of 2008 2500 cmd.exe 17
Processes
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60001⤵
- Runs ping.exe
PID:2008
-
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\177bea98bc7f1be882066b749f8ac547.exe"1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2500
-
C:\Users\Admin\AppData\Local\Temp\177bea98bc7f1be882066b749f8ac547.exe"C:\Users\Admin\AppData\Local\Temp\177bea98bc7f1be882066b749f8ac547.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516