Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
877816d10f29e89bff6dd39fa88eab2e.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
877816d10f29e89bff6dd39fa88eab2e.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
877816d10f29e89bff6dd39fa88eab2e.exe
-
Size
644KB
-
MD5
877816d10f29e89bff6dd39fa88eab2e
-
SHA1
89586d70e8345325857f972c953d2575defb1f86
-
SHA256
a2a562a4aab40e8a0045eac028e052e6de678d8ba329307ef65f5519603effcd
-
SHA512
d377a66693f9f2466095d51d892c5dc880a8dfbd5cea5405b4d9658d4a2fd4cea1267b45299e4110f3014df6538ae962544bb081d894660f91bf95d4076fd809
-
SSDEEP
12288:FytbV3kSoXaLnTosl+FRoludcaR90soqYzLmTT0y1asHdMgK:Eb5kSYaLTVl+/+udcaRb+6PjaidMgK
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2664 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3040 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 808 877816d10f29e89bff6dd39fa88eab2e.exe 808 877816d10f29e89bff6dd39fa88eab2e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 808 877816d10f29e89bff6dd39fa88eab2e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 808 wrote to memory of 2664 808 877816d10f29e89bff6dd39fa88eab2e.exe 28 PID 808 wrote to memory of 2664 808 877816d10f29e89bff6dd39fa88eab2e.exe 28 PID 808 wrote to memory of 2664 808 877816d10f29e89bff6dd39fa88eab2e.exe 28 PID 2664 wrote to memory of 3040 2664 cmd.exe 30 PID 2664 wrote to memory of 3040 2664 cmd.exe 30 PID 2664 wrote to memory of 3040 2664 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\877816d10f29e89bff6dd39fa88eab2e.exe"C:\Users\Admin\AppData\Local\Temp\877816d10f29e89bff6dd39fa88eab2e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\877816d10f29e89bff6dd39fa88eab2e.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:3040
-
-