Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfc5ab1da7d8c909e842b462f933e9d2.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
bfc5ab1da7d8c909e842b462f933e9d2.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
bfc5ab1da7d8c909e842b462f933e9d2.exe
-
Size
488KB
-
MD5
bfc5ab1da7d8c909e842b462f933e9d2
-
SHA1
8326d1e197f49d37d1164cb09cd6479e8f6e1665
-
SHA256
fc3c5ee0873ccd7bda7addc6c5e4703e1979c9c3623fcff69a1848ae110a75a4
-
SHA512
ef044d5c475727d497fd8bb91ae9d066dadc60d5cacde462e65dd133f7ac232cbbcd99ed67e61d02505c8ee8f5b57bde0801367a6a984a3715cffd5decbe0754
-
SSDEEP
12288:FytbV3kSoXaLnTosl+o0CxKXIV5weQufro:Eb5kSYaLTVl+oz8O59/ro
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4892 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3768 bfc5ab1da7d8c909e842b462f933e9d2.exe 3768 bfc5ab1da7d8c909e842b462f933e9d2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3768 bfc5ab1da7d8c909e842b462f933e9d2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2736 3768 bfc5ab1da7d8c909e842b462f933e9d2.exe 89 PID 3768 wrote to memory of 2736 3768 bfc5ab1da7d8c909e842b462f933e9d2.exe 89 PID 2736 wrote to memory of 4892 2736 cmd.exe 91 PID 2736 wrote to memory of 4892 2736 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfc5ab1da7d8c909e842b462f933e9d2.exe"C:\Users\Admin\AppData\Local\Temp\bfc5ab1da7d8c909e842b462f933e9d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\bfc5ab1da7d8c909e842b462f933e9d2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:4892
-
-