Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1bin/cmd.lnk
windows7-x64
3bin/cmd.lnk
windows10-2004-x64
7cleanup.cmd
windows7-x64
1cleanup.cmd
windows10-2004-x64
1crypt/crypt.xml
windows7-x64
1crypt/crypt.xml
windows10-2004-x64
1main.vbs
windows7-x64
1main.vbs
windows10-2004-x64
1svbot.xml
windows7-x64
1svbot.xml
windows10-2004-x64
1test/test.xml
windows7-x64
1test/test.xml
windows10-2004-x64
1Analysis
-
max time kernel
11s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11/05/2023, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
bin/cmd.lnk
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bin/cmd.lnk
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
cleanup.cmd
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
cleanup.cmd
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
crypt/crypt.xml
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
crypt/crypt.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
main.vbs
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
main.vbs
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
svbot.xml
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
svbot.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
test/test.xml
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
test/test.xml
Resource
win10v2004-20230220-en
General
-
Target
bin/cmd.lnk
-
Size
499B
-
MD5
a4c3faf37892b1fa14272549acd00a42
-
SHA1
4d65f7f3a7ecb5414826f5f3e8e82737ae114345
-
SHA256
9a203afa0f57f8d15a654fa05aee0d076a2391dc3759a1cfb643e49454b10996
-
SHA512
6c1bc6e4a7b9e17757d287c701108759f4ebe78483358502eb8452f9987b0b4091a94bda765e90e90ab399c9ddb36c648c7b8adeabd496079181b3580f817911
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1832 1420 cmd.exe 29 PID 1420 wrote to memory of 1832 1420 cmd.exe 29 PID 1420 wrote to memory of 1832 1420 cmd.exe 29