Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
182s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
177bea98bc7f1be882066b749f8ac547.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
177bea98bc7f1be882066b749f8ac547.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
177bea98bc7f1be882066b749f8ac547.exe
-
Size
488KB
-
MD5
177bea98bc7f1be882066b749f8ac547
-
SHA1
94b7e9e05ea79fc042c379e4d1b388eb23083d5b
-
SHA256
54d107fd8cb067ff034ad32c63171bf2201a94b6fe0f02eb1d168304b8699c71
-
SHA512
825bcd85ce3ff1cffb5a6ee691b26bc50ed8019c83c4742cea7557e1ccaae6d698cfc8d76600fdc2e0c9e75bfa77653ba1e827e414743d9a53d27c8a5e56134c
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE+BA5ADVVLqg+i+kwWX9Xv6F0OY2RPH7VK:FytbV3kSoXaLnToslvHDOvxWQCOF5PsV
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1952 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2808 177bea98bc7f1be882066b749f8ac547.exe 2808 177bea98bc7f1be882066b749f8ac547.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2808 177bea98bc7f1be882066b749f8ac547.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2808 wrote to memory of 5044 2808 177bea98bc7f1be882066b749f8ac547.exe 86 PID 2808 wrote to memory of 5044 2808 177bea98bc7f1be882066b749f8ac547.exe 86 PID 5044 wrote to memory of 1952 5044 cmd.exe 88 PID 5044 wrote to memory of 1952 5044 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\177bea98bc7f1be882066b749f8ac547.exe"C:\Users\Admin\AppData\Local\Temp\177bea98bc7f1be882066b749f8ac547.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\177bea98bc7f1be882066b749f8ac547.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:1952
-
-