Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 08:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c83625647913fb3b0a340e75284c22ad.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c83625647913fb3b0a340e75284c22ad.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
c83625647913fb3b0a340e75284c22ad.exe
-
Size
488KB
-
MD5
c83625647913fb3b0a340e75284c22ad
-
SHA1
d86a244ba36e29adbad1cb4e08ebf28b3c988d4e
-
SHA256
5b72d24ffbc0572872a01c9ecbcc6bf7aea0e9d689089b742ede7ad3c02e9e1c
-
SHA512
c9a928b62f0c697d5ec8a859002a54bfa99f88fbbe171dc305cb1981b7bbec7290336cfd172a0380413f5c43e0487ac12c60f85f0dcf8c32ae8c62dd97ba61b2
-
SSDEEP
6144:FUORK1ttbV3kSobTYZGiNdniCoh+KiEwIReZuXGwVtuaVVMwcdRSmRISN50:FytbV3kSoXaLnTosl2R1X99V+dRS7SU
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2512 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2588 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2784 c83625647913fb3b0a340e75284c22ad.exe 2784 c83625647913fb3b0a340e75284c22ad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2784 c83625647913fb3b0a340e75284c22ad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2512 2784 c83625647913fb3b0a340e75284c22ad.exe 28 PID 2784 wrote to memory of 2512 2784 c83625647913fb3b0a340e75284c22ad.exe 28 PID 2784 wrote to memory of 2512 2784 c83625647913fb3b0a340e75284c22ad.exe 28 PID 2512 wrote to memory of 2588 2512 cmd.exe 30 PID 2512 wrote to memory of 2588 2512 cmd.exe 30 PID 2512 wrote to memory of 2588 2512 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83625647913fb3b0a340e75284c22ad.exe"C:\Users\Admin\AppData\Local\Temp\c83625647913fb3b0a340e75284c22ad.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\c83625647913fb3b0a340e75284c22ad.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2588
-
-