Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
413s -
max time network
1134s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/09/2024, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
5.bat
Resource
win11-20240802-en
3 signatures
1800 seconds
General
-
Target
5.bat
-
Size
417B
-
MD5
2d2df45f296a77260b52dd355dc393b7
-
SHA1
df6f7ebe9eb18ef71257c272e0d539a157351132
-
SHA256
240b45a58b57fc2b19bd224a6f17a43eef33c8af85d84f3bacf42f1b8ee92055
-
SHA512
5810ac5df329b0b6b08a2d1aa2ad3db3ab0bb9d3da42e204c50c5a08b3f4c47d51112eaed9e7bf04cdd3bd4b8e216b4d144efdf3c94c3912904dafe2b3595c12
Score
3/10
Malware Config
Signatures
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1500 PING.EXE 2832 PING.EXE 2328 PING.EXE 2748 PING.EXE -
Runs ping.exe 1 TTPs 4 IoCs
pid Process 2748 PING.EXE 1500 PING.EXE 2832 PING.EXE 2328 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1500 4920 cmd.exe 79 PID 4920 wrote to memory of 1500 4920 cmd.exe 79 PID 4920 wrote to memory of 2832 4920 cmd.exe 80 PID 4920 wrote to memory of 2832 4920 cmd.exe 80 PID 4920 wrote to memory of 2328 4920 cmd.exe 81 PID 4920 wrote to memory of 2328 4920 cmd.exe 81 PID 4920 wrote to memory of 2748 4920 cmd.exe 82 PID 4920 wrote to memory of 2748 4920 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\5.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\PING.EXEping localhost -n 52⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1500
-
-
C:\Windows\system32\PING.EXEping localhost -n 52⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2832
-
-
C:\Windows\system32\PING.EXEping localhost -n 22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2328
-
-
C:\Windows\system32\PING.EXEping localhost -n 32⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2748
-