Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 07:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6702689ed16cdbb1460c0cfe9422f857.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
6702689ed16cdbb1460c0cfe9422f857.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
6702689ed16cdbb1460c0cfe9422f857.exe
-
Size
488KB
-
MD5
6702689ed16cdbb1460c0cfe9422f857
-
SHA1
9b6fc7f9f7ded9a0ca0a2e2a9783d9c250f45b2c
-
SHA256
177e515c18717e1c76c489b2d34d36c4353cbda7cbe6f9802a053044a424d6ea
-
SHA512
53cb9bd084680b89be82fe34fc43b5b71cfd7fbf22431cd75cb66d20acc6ed9131be834d162cc6d2cb65931eb03ddc111701e9dd075ce1e18da0d93e09dce15e
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEJfrvkXbaXTjmkkmj7+3fCtLSXBTREJ/6n:FytbV3kSoXaLnToslermbaGkzu3frGw1
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5096 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1980 6702689ed16cdbb1460c0cfe9422f857.exe 1980 6702689ed16cdbb1460c0cfe9422f857.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1980 6702689ed16cdbb1460c0cfe9422f857.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1888 1980 6702689ed16cdbb1460c0cfe9422f857.exe 86 PID 1980 wrote to memory of 1888 1980 6702689ed16cdbb1460c0cfe9422f857.exe 86 PID 1888 wrote to memory of 5096 1888 cmd.exe 89 PID 1888 wrote to memory of 5096 1888 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\6702689ed16cdbb1460c0cfe9422f857.exe"C:\Users\Admin\AppData\Local\Temp\6702689ed16cdbb1460c0cfe9422f857.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\6702689ed16cdbb1460c0cfe9422f857.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:5096
-
-