Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 16:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
805673f5c034742187f3ac00286c81f7.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
805673f5c034742187f3ac00286c81f7.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
805673f5c034742187f3ac00286c81f7.exe
-
Size
488KB
-
MD5
805673f5c034742187f3ac00286c81f7
-
SHA1
d97aed0fe4b5b3263ca0c798e571ea108d45535f
-
SHA256
5bad7011357187a40b60609d3985086f170f33a4d8ce937238668a8a7c646f95
-
SHA512
1912394d9cd7784c3e2e3d9e8bb800ac4a7ee81c9e005be483c4e6a2a46a30f0402cc13b338ab00c248090c09559534af08dccf63102629a95c0f4dd0458db9c
-
SSDEEP
12288:FytbV3kSoXaLnToslneRgf/guBMh6oYC3ni:Eb5kSYaLTVlVjGh6mXi
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3504 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1240 805673f5c034742187f3ac00286c81f7.exe 1240 805673f5c034742187f3ac00286c81f7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1240 805673f5c034742187f3ac00286c81f7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1240 wrote to memory of 220 1240 805673f5c034742187f3ac00286c81f7.exe 83 PID 1240 wrote to memory of 220 1240 805673f5c034742187f3ac00286c81f7.exe 83 PID 220 wrote to memory of 3504 220 cmd.exe 85 PID 220 wrote to memory of 3504 220 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\805673f5c034742187f3ac00286c81f7.exe"C:\Users\Admin\AppData\Local\Temp\805673f5c034742187f3ac00286c81f7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\805673f5c034742187f3ac00286c81f7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:3504
-
-