Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 05:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
649300b06a02daed7dfa393cb2f5f02c.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
649300b06a02daed7dfa393cb2f5f02c.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
649300b06a02daed7dfa393cb2f5f02c.exe
-
Size
488KB
-
MD5
649300b06a02daed7dfa393cb2f5f02c
-
SHA1
9add1f629a526e66aa258f52ea9ce03b57254351
-
SHA256
b385c67a0552e18361a361ee97c9040cb149bc3e4b8ea3c3a0bc94179cb59605
-
SHA512
40551dec009920c431bb0935596d153a6be68d1c81b9ecb6d1c9482d8a6ce3032ec45e72aa59c58d4d082c5fa6a4919a8ef8ae381516e4ff3b5649c10c7d7ec4
-
SSDEEP
12288:FytbV3kSoXaLnToslub4pXKDpLoKigsa4P/VMpK:Eb5kSYaLTVlub4xKVMgsl3J
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3676 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 649300b06a02daed7dfa393cb2f5f02c.exe 3988 649300b06a02daed7dfa393cb2f5f02c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3988 649300b06a02daed7dfa393cb2f5f02c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3988 wrote to memory of 2724 3988 649300b06a02daed7dfa393cb2f5f02c.exe 19 PID 3988 wrote to memory of 2724 3988 649300b06a02daed7dfa393cb2f5f02c.exe 19 PID 2724 wrote to memory of 3676 2724 cmd.exe 20 PID 2724 wrote to memory of 3676 2724 cmd.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\649300b06a02daed7dfa393cb2f5f02c.exe"C:\Users\Admin\AppData\Local\Temp\649300b06a02daed7dfa393cb2f5f02c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\649300b06a02daed7dfa393cb2f5f02c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:3676
-
-