Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2197678d234bbdac9f61eb4a1391068.exe
Resource
win7-20240215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2197678d234bbdac9f61eb4a1391068.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
c2197678d234bbdac9f61eb4a1391068.exe
-
Size
488KB
-
MD5
c2197678d234bbdac9f61eb4a1391068
-
SHA1
7656fc0db82ffc6c50722ee1e98c480c19e02752
-
SHA256
26ec60cc77a0056c9c9ee2f0bcd40db2249d603f828e2035fcbf71388edd2e55
-
SHA512
10a4ab945e5c87604df405646888b5c360437accbbd7870b8fc29a86eeb9a4757beb519ac0db6b8d1ed4fe01040e951bb1c54bd74facf4d55171e2dce6c49a13
-
SSDEEP
12288:FytbV3kSoXaLnTosltAFCaW7gS+Hxc9Dfyu22pc+:Eb5kSYaLTVlU3W7YC5XXc+
Score
1/10
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1736 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 c2197678d234bbdac9f61eb4a1391068.exe 4964 c2197678d234bbdac9f61eb4a1391068.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4964 c2197678d234bbdac9f61eb4a1391068.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4964 wrote to memory of 2276 4964 c2197678d234bbdac9f61eb4a1391068.exe 90 PID 4964 wrote to memory of 2276 4964 c2197678d234bbdac9f61eb4a1391068.exe 90 PID 2276 wrote to memory of 1736 2276 cmd.exe 92 PID 2276 wrote to memory of 1736 2276 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2197678d234bbdac9f61eb4a1391068.exe"C:\Users\Admin\AppData\Local\Temp\c2197678d234bbdac9f61eb4a1391068.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\c2197678d234bbdac9f61eb4a1391068.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:1736
-
-