Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
4df2fb866ada30a04bfc5d2bdd6e41a1.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4df2fb866ada30a04bfc5d2bdd6e41a1.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
4df2fb866ada30a04bfc5d2bdd6e41a1.exe
-
Size
458KB
-
MD5
4df2fb866ada30a04bfc5d2bdd6e41a1
-
SHA1
4b8d14b2ad7bcd6ca17a36ddc67874aa0a758954
-
SHA256
061b6ab1fb79088b197f20263fcc854ac6c2b0aa1bf6d63eedba4deb53f39a4e
-
SHA512
e6a30d4bc929b0ecf15d185cbbe31c8f389c8c47764c1efd041ab865616c253977d23e83108f9356b9340518731c94c4747a6278b12ae439ae4ea3e74ef638df
-
SSDEEP
6144:CpW/YYl/MOGP/gvXg8pkKXfokq1KINd1MK/Yh2y/OO5lLTXE3biMasgLeZ9:tL/MGXgg9XkT1MK/Ygy/TXEGM59
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2816 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2584 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 836 wrote to memory of 2816 836 4df2fb866ada30a04bfc5d2bdd6e41a1.exe 32 PID 836 wrote to memory of 2816 836 4df2fb866ada30a04bfc5d2bdd6e41a1.exe 32 PID 836 wrote to memory of 2816 836 4df2fb866ada30a04bfc5d2bdd6e41a1.exe 32 PID 836 wrote to memory of 2816 836 4df2fb866ada30a04bfc5d2bdd6e41a1.exe 32 PID 2816 wrote to memory of 2584 2816 cmd.exe 30 PID 2816 wrote to memory of 2584 2816 cmd.exe 30 PID 2816 wrote to memory of 2584 2816 cmd.exe 30 PID 2816 wrote to memory of 2584 2816 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df2fb866ada30a04bfc5d2bdd6e41a1.exe"C:\Users\Admin\AppData\Local\Temp\4df2fb866ada30a04bfc5d2bdd6e41a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4df2fb866ada30a04bfc5d2bdd6e41a1.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2816
-
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30001⤵
- Runs ping.exe
PID:2584