Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
860cba6a9f4678b776dba28261e73bca.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
860cba6a9f4678b776dba28261e73bca.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
860cba6a9f4678b776dba28261e73bca.exe
-
Size
458KB
-
MD5
860cba6a9f4678b776dba28261e73bca
-
SHA1
3fa8dfe2814d6910cfac2f6335533dcb61ae7a83
-
SHA256
12adb8c70bc368d06397363ce009bded9d7cd54335e3e8eaa535352a58a9d936
-
SHA512
1037aee67c8500efe1f4259b68e32db358fe0b4d7131cf307353fc6cd0d47f29054fed67d735cabfa03afd066a08ef2d7aea48902624e0291ad416a4c4187775
-
SSDEEP
6144:LhcI8Q4aYvSBLRP4bdIMOZ/feg1RNpxDjVZWj/xTONRp23gmzfYnXK:LheatDP4b/6RL5jVc9ONRpaz2XK
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2196 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1664 2856 860cba6a9f4678b776dba28261e73bca.exe 88 PID 2856 wrote to memory of 1664 2856 860cba6a9f4678b776dba28261e73bca.exe 88 PID 2856 wrote to memory of 1664 2856 860cba6a9f4678b776dba28261e73bca.exe 88 PID 1664 wrote to memory of 2196 1664 cmd.exe 90 PID 1664 wrote to memory of 2196 1664 cmd.exe 90 PID 1664 wrote to memory of 2196 1664 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\860cba6a9f4678b776dba28261e73bca.exe"C:\Users\Admin\AppData\Local\Temp\860cba6a9f4678b776dba28261e73bca.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\860cba6a9f4678b776dba28261e73bca.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2196
-
-