Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
4PingCastle....1.zip
windows7-x64
1PingCastle....1.zip
windows10-2004-x64
1Active Dir....4.pdf
windows7-x64
1Active Dir....4.pdf
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1PingCastle v3.0.0.pdf
windows7-x64
1PingCastle v3.0.0.pdf
windows10-2004-x64
1PingCastle.exe
windows7-x64
1PingCastle.exe
windows10-2004-x64
1PingCastle.exe.xml
windows7-x64
1PingCastle.exe.xml
windows10-2004-x64
1PingCastle.pdb
windows7-x64
3PingCastle.pdb
windows10-2004-x64
3PingCastle...er.exe
windows7-x64
1PingCastle...er.exe
windows10-2004-x64
1PingCastle...xe.xml
windows7-x64
1PingCastle...xe.xml
windows10-2004-x64
1PingCastle...er.pdb
windows7-x64
3PingCastle...er.pdb
windows10-2004-x64
3changelog.txt
windows7-x64
1changelog.txt
windows10-2004-x64
1license.rtf
windows7-x64
4license.rtf
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 14:07
Behavioral task
behavioral1
Sample
PingCastle_3.1.0.1.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PingCastle_3.1.0.1.zip
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Active Directory Security Self Assessment v1.4.pdf
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Active Directory Security Self Assessment v1.4.pdf
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
PingCastle v3.0.0.pdf
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
PingCastle v3.0.0.pdf
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
PingCastle.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
PingCastle.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
PingCastle.exe.xml
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
PingCastle.exe.xml
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
PingCastle.pdb
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
PingCastle.pdb
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
PingCastleAutoUpdater.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
PingCastleAutoUpdater.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
PingCastleAutoUpdater.exe.xml
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
PingCastleAutoUpdater.exe.xml
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
PingCastleAutoUpdater.pdb
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
PingCastleAutoUpdater.pdb
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
changelog.txt
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
changelog.txt
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
license.rtf
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
license.rtf
Resource
win10v2004-20231222-en
General
-
Target
PingCastleAutoUpdater.pdb
-
Size
23KB
-
MD5
bcd63f08524588a816486e4b358b932c
-
SHA1
e5cd01e0fa25f73ee969b272623421c619c2a4ed
-
SHA256
7ccf1dd7d6e7429908aae9f544444b0a42170b7028c4ff87b0a4f06991b536c6
-
SHA512
8227687a3e8e09807ef19c053bf478c2b47dbdbf1d2ecc821fd470d109dea226dd49feef1203111da6f543b1e0068e15e3327573b5a50af15a7d03b65b04fe3d
-
SSDEEP
192:mAz0APjAPVdAPiidIidxid8cOWNu4sAa8Hd0NvPUGQUMmR5wU/JPwa2pemeHBnvU:VAsiHGUOWOAa8HyCj00x
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4864 OpenWith.exe