Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 12:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67a52def256b219c787b9b0ac0291eab.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
67a52def256b219c787b9b0ac0291eab.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
67a52def256b219c787b9b0ac0291eab.exe
-
Size
316KB
-
MD5
67a52def256b219c787b9b0ac0291eab
-
SHA1
08b20012a15d2568f2c9ec38acea6b675847d76e
-
SHA256
c4c5fb9b0a901ecc82529f94fa00e3b76828852ba9357827680aff7a27b2b42b
-
SHA512
d0b8f6fb112b707549f147b72d6d7b98ab48c32fbc45251a37a14c4472c1d8c6c47bcb6a154986b5427cef02edb31be1805a621d1026323037e0b4babc579b3c
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEfnk6FS6cd1bha:FytbV3kSoXaLnToslCnKLjbha
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2296 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2688 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2856 67a52def256b219c787b9b0ac0291eab.exe 2856 67a52def256b219c787b9b0ac0291eab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2856 67a52def256b219c787b9b0ac0291eab.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2296 2856 67a52def256b219c787b9b0ac0291eab.exe 28 PID 2856 wrote to memory of 2296 2856 67a52def256b219c787b9b0ac0291eab.exe 28 PID 2856 wrote to memory of 2296 2856 67a52def256b219c787b9b0ac0291eab.exe 28 PID 2296 wrote to memory of 2688 2296 cmd.exe 30 PID 2296 wrote to memory of 2688 2296 cmd.exe 30 PID 2296 wrote to memory of 2688 2296 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\67a52def256b219c787b9b0ac0291eab.exe"C:\Users\Admin\AppData\Local\Temp\67a52def256b219c787b9b0ac0291eab.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\67a52def256b219c787b9b0ac0291eab.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2688
-
-