Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 14:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8007a61c73878c1d1d40f1af5e2f3bd1.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8007a61c73878c1d1d40f1af5e2f3bd1.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
8007a61c73878c1d1d40f1af5e2f3bd1.exe
-
Size
316KB
-
MD5
8007a61c73878c1d1d40f1af5e2f3bd1
-
SHA1
e8e84b3f88b99ab2666b116a043a53fe9efd36ba
-
SHA256
6b19645321a86f259b328bc17e8c565aed112d681956defe2550612e29c3039b
-
SHA512
0c0ce7e5872f8fd143ed8c1f74ec54952f4501ba40ef5cc2e427c176ba9033fc68f4d3da868cf763651df96ae7d98651bb1408950fb0f92ec1ae192176ecfb8e
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEBj5w:FytbV3kSoXaLnTosluj5w
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 220 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3312 8007a61c73878c1d1d40f1af5e2f3bd1.exe 3312 8007a61c73878c1d1d40f1af5e2f3bd1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3312 8007a61c73878c1d1d40f1af5e2f3bd1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3312 wrote to memory of 2736 3312 8007a61c73878c1d1d40f1af5e2f3bd1.exe 33 PID 3312 wrote to memory of 2736 3312 8007a61c73878c1d1d40f1af5e2f3bd1.exe 33 PID 2736 wrote to memory of 220 2736 cmd.exe 35 PID 2736 wrote to memory of 220 2736 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\8007a61c73878c1d1d40f1af5e2f3bd1.exe"C:\Users\Admin\AppData\Local\Temp\8007a61c73878c1d1d40f1af5e2f3bd1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8007a61c73878c1d1d40f1af5e2f3bd1.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:220
-
-