Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 07:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe
-
Size
316KB
-
MD5
2d7aeeaad7f09f43c59ae1ada7b2ee0e
-
SHA1
95c58bc05413f089e4b5f921ea38a383b6dd0c96
-
SHA256
b9b17f3f3cee1612b02ad24776705168656d1485a024443a282fac0360d451a8
-
SHA512
cb6ada509dc19ad1d21ed674ccd0169c8eff573209ce5fc9d196913e50b50074ca01913681ee2c9ba36c69f6e22449e0b4e97ac707d478016fbf4bf4ecbd3cd3
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiE7V84OL:FytbV3kSoXaLnToslEmL
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1756 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4268 2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe 4268 2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4268 2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4652 4268 2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe 21 PID 4268 wrote to memory of 4652 4268 2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe 21 PID 4652 wrote to memory of 1756 4652 cmd.exe 16 PID 4652 wrote to memory of 1756 4652 cmd.exe 16
Processes
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60001⤵
- Runs ping.exe
PID:1756
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652
-
C:\Users\Admin\AppData\Local\Temp\2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe"C:\Users\Admin\AppData\Local\Temp\2d7aeeaad7f09f43c59ae1ada7b2ee0e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268