Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2197678d234bbdac9f61eb4a1391068.exe
Resource
win7-20240215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2197678d234bbdac9f61eb4a1391068.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
c2197678d234bbdac9f61eb4a1391068.exe
-
Size
488KB
-
MD5
c2197678d234bbdac9f61eb4a1391068
-
SHA1
7656fc0db82ffc6c50722ee1e98c480c19e02752
-
SHA256
26ec60cc77a0056c9c9ee2f0bcd40db2249d603f828e2035fcbf71388edd2e55
-
SHA512
10a4ab945e5c87604df405646888b5c360437accbbd7870b8fc29a86eeb9a4757beb519ac0db6b8d1ed4fe01040e951bb1c54bd74facf4d55171e2dce6c49a13
-
SSDEEP
12288:FytbV3kSoXaLnTosltAFCaW7gS+Hxc9Dfyu22pc+:Eb5kSYaLTVlU3W7YC5XXc+
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1936 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2632 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2108 c2197678d234bbdac9f61eb4a1391068.exe 2108 c2197678d234bbdac9f61eb4a1391068.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2108 c2197678d234bbdac9f61eb4a1391068.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1936 2108 c2197678d234bbdac9f61eb4a1391068.exe 28 PID 2108 wrote to memory of 1936 2108 c2197678d234bbdac9f61eb4a1391068.exe 28 PID 2108 wrote to memory of 1936 2108 c2197678d234bbdac9f61eb4a1391068.exe 28 PID 1936 wrote to memory of 2632 1936 cmd.exe 30 PID 1936 wrote to memory of 2632 1936 cmd.exe 30 PID 1936 wrote to memory of 2632 1936 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2197678d234bbdac9f61eb4a1391068.exe"C:\Users\Admin\AppData\Local\Temp\c2197678d234bbdac9f61eb4a1391068.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\c2197678d234bbdac9f61eb4a1391068.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2632
-
-