Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
sky net for W3/Clear.bat
Resource
win7-20221111-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
sky net for W3/Clear.bat
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
sky net for W3/sky net for W3.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
sky net for W3/sky net for W3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
sky net for W3/streamreader.dll
Resource
win7-20221111-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
sky net for W3/streamreader.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
sky net for W3/sky net for W3.exe
-
Size
372KB
-
MD5
b1453e8dad772d9bd589a7ed3b9b2098
-
SHA1
0e61d3e31b7339a20453cd77a4471b45a870b14b
-
SHA256
f6dec3e90080418799406aaf1f3ae35e448374c36f0c888790307fe6be3f766e
-
SHA512
1e27c0820d15849ffe5ce13ac6498f415875671ee30d234addae01a758745b1c263aa8115d99ceb06253744184e7fc647dfaec7a57bebf4f7f9114c799e3ac72
-
SSDEEP
6144:Cn/J6Xt0rr2ss7jrT+A0vdaIArVxiyBb8fDukrEbU+dEaIQ1fmekC9nvKpjleYj8:Qx6XtCrlArV1B0DgA+dEaIQ1fmekC9nP
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1096 sky net for W3.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe 1096 sky net for W3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1096 sky net for W3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 368 1096 sky net for W3.exe 5 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 376 1096 sky net for W3.exe 4 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 416 1096 sky net for W3.exe 3 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 464 1096 sky net for W3.exe 2 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 472 1096 sky net for W3.exe 1 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 480 1096 sky net for W3.exe 8 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 596 1096 sky net for W3.exe 21 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 672 1096 sky net for W3.exe 20 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 756 1096 sky net for W3.exe 19 PID 1096 wrote to memory of 800 1096 sky net for W3.exe 9
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:472
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:800
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1192
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:880
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵PID:1848
-
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:980
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1128
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1064
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:284
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:844
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:756
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:672
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:596
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵PID:1992
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:808
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1212
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:480
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\sky net for W3\sky net for W3.exe"C:\Users\Admin\AppData\Local\Temp\sky net for W3\sky net for W3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
-