Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2024, 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
703f2da1daaa6abf617c931c39cba4a8.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
703f2da1daaa6abf617c931c39cba4a8.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
703f2da1daaa6abf617c931c39cba4a8.exe
-
Size
488KB
-
MD5
703f2da1daaa6abf617c931c39cba4a8
-
SHA1
cfa79854520c3acb950c55f1f60174f2f68eeaf6
-
SHA256
803b6b3b68524e80ca1b04d3a8f9ba31d9859aadb897f9cbfaf4fd3bf6c4ba22
-
SHA512
ea8790c17f90ffd928c18d318091d04ac066ff24564e130aa7609f8001a42b056cdfa981a2a24119bae263639357da6b9867cf6d4273a67df10a077b1b27015f
-
SSDEEP
12288:FytbV3kSoXaLnToslQ92Ed7235ONYhF/ZF:Eb5kSYaLTVlqwP3/H
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1200 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2416 703f2da1daaa6abf617c931c39cba4a8.exe 2416 703f2da1daaa6abf617c931c39cba4a8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2416 703f2da1daaa6abf617c931c39cba4a8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 3708 2416 703f2da1daaa6abf617c931c39cba4a8.exe 85 PID 2416 wrote to memory of 3708 2416 703f2da1daaa6abf617c931c39cba4a8.exe 85 PID 3708 wrote to memory of 1200 3708 cmd.exe 87 PID 3708 wrote to memory of 1200 3708 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\703f2da1daaa6abf617c931c39cba4a8.exe"C:\Users\Admin\AppData\Local\Temp\703f2da1daaa6abf617c931c39cba4a8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\703f2da1daaa6abf617c931c39cba4a8.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:1200
-
-