Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a4e113614b84cb0d1c67480a92da709.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a4e113614b84cb0d1c67480a92da709.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
3a4e113614b84cb0d1c67480a92da709.exe
-
Size
544KB
-
MD5
3a4e113614b84cb0d1c67480a92da709
-
SHA1
2c23c0de6d8e896f9ce9a4ef1d731855cc9c8a7b
-
SHA256
09caf47d55bffb317fee793467d717b3223b56b80764e080ef3ef1d469820b75
-
SHA512
5df55c75a46ca3ea44c1f6a0c39b442e0ffa69df3457af4bf30f0d9abdaae45835450983de714337029bd427b8b0420a94b609b5b25c49400e38f08213a013f0
-
SSDEEP
12288:FytbV3kSoXaLnTosl5VKG6qLaK9n6u5ZNtit5u:Eb5kSYaLTVl5IBmaK9nB5ZyO
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3752 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4756 3a4e113614b84cb0d1c67480a92da709.exe 4756 3a4e113614b84cb0d1c67480a92da709.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4756 3a4e113614b84cb0d1c67480a92da709.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2904 4756 3a4e113614b84cb0d1c67480a92da709.exe 23 PID 4756 wrote to memory of 2904 4756 3a4e113614b84cb0d1c67480a92da709.exe 23 PID 2904 wrote to memory of 3752 2904 cmd.exe 21 PID 2904 wrote to memory of 3752 2904 cmd.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4e113614b84cb0d1c67480a92da709.exe"C:\Users\Admin\AppData\Local\Temp\3a4e113614b84cb0d1c67480a92da709.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\3a4e113614b84cb0d1c67480a92da709.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2904
-
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60001⤵
- Runs ping.exe
PID:3752