Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
860cba6a9f4678b776dba28261e73bca.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
860cba6a9f4678b776dba28261e73bca.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
860cba6a9f4678b776dba28261e73bca.exe
-
Size
458KB
-
MD5
860cba6a9f4678b776dba28261e73bca
-
SHA1
3fa8dfe2814d6910cfac2f6335533dcb61ae7a83
-
SHA256
12adb8c70bc368d06397363ce009bded9d7cd54335e3e8eaa535352a58a9d936
-
SHA512
1037aee67c8500efe1f4259b68e32db358fe0b4d7131cf307353fc6cd0d47f29054fed67d735cabfa03afd066a08ef2d7aea48902624e0291ad416a4c4187775
-
SSDEEP
6144:LhcI8Q4aYvSBLRP4bdIMOZ/feg1RNpxDjVZWj/xTONRp23gmzfYnXK:LheatDP4b/6RL5jVc9ONRpaz2XK
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3060 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2352 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2520 wrote to memory of 3060 2520 860cba6a9f4678b776dba28261e73bca.exe 33 PID 2520 wrote to memory of 3060 2520 860cba6a9f4678b776dba28261e73bca.exe 33 PID 2520 wrote to memory of 3060 2520 860cba6a9f4678b776dba28261e73bca.exe 33 PID 2520 wrote to memory of 3060 2520 860cba6a9f4678b776dba28261e73bca.exe 33 PID 3060 wrote to memory of 2352 3060 cmd.exe 35 PID 3060 wrote to memory of 2352 3060 cmd.exe 35 PID 3060 wrote to memory of 2352 3060 cmd.exe 35 PID 3060 wrote to memory of 2352 3060 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\860cba6a9f4678b776dba28261e73bca.exe"C:\Users\Admin\AppData\Local\Temp\860cba6a9f4678b776dba28261e73bca.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\860cba6a9f4678b776dba28261e73bca.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2352
-
-