Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfc5ab1da7d8c909e842b462f933e9d2.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
bfc5ab1da7d8c909e842b462f933e9d2.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
bfc5ab1da7d8c909e842b462f933e9d2.exe
-
Size
488KB
-
MD5
bfc5ab1da7d8c909e842b462f933e9d2
-
SHA1
8326d1e197f49d37d1164cb09cd6479e8f6e1665
-
SHA256
fc3c5ee0873ccd7bda7addc6c5e4703e1979c9c3623fcff69a1848ae110a75a4
-
SHA512
ef044d5c475727d497fd8bb91ae9d066dadc60d5cacde462e65dd133f7ac232cbbcd99ed67e61d02505c8ee8f5b57bde0801367a6a984a3715cffd5decbe0754
-
SSDEEP
12288:FytbV3kSoXaLnTosl+o0CxKXIV5weQufro:Eb5kSYaLTVl+oz8O59/ro
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2692 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2260 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1880 bfc5ab1da7d8c909e842b462f933e9d2.exe 1880 bfc5ab1da7d8c909e842b462f933e9d2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1880 bfc5ab1da7d8c909e842b462f933e9d2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2692 1880 bfc5ab1da7d8c909e842b462f933e9d2.exe 28 PID 1880 wrote to memory of 2692 1880 bfc5ab1da7d8c909e842b462f933e9d2.exe 28 PID 1880 wrote to memory of 2692 1880 bfc5ab1da7d8c909e842b462f933e9d2.exe 28 PID 2692 wrote to memory of 2260 2692 cmd.exe 30 PID 2692 wrote to memory of 2260 2692 cmd.exe 30 PID 2692 wrote to memory of 2260 2692 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfc5ab1da7d8c909e842b462f933e9d2.exe"C:\Users\Admin\AppData\Local\Temp\bfc5ab1da7d8c909e842b462f933e9d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\bfc5ab1da7d8c909e842b462f933e9d2.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2260
-
-