Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10AutoSettin...ck.bat
windows7-x64
7AutoSettin...ck.bat
windows10-2004-x64
7AutoSettin...ck.bat
windows7-x64
7AutoSettin...ck.bat
windows10-2004-x64
7AutoSettin...cs.bat
windows7-x64
7AutoSettin...cs.bat
windows10-2004-x64
7AutoSettin...rs.bat
windows7-x64
7AutoSettin...rs.bat
windows10-2004-x64
7AutoSettin...gs.bat
windows7-x64
1AutoSettin...gs.bat
windows10-2004-x64
1AutoSettin...7z.dll
windows7-x64
3AutoSettin...7z.dll
windows10-2004-x64
3AutoSettin...7z.exe
windows7-x64
1AutoSettin...7z.exe
windows10-2004-x64
1AutoSettin...er.exe
windows7-x64
1AutoSettin...er.exe
windows10-2004-x64
1AutoSettin...le.exe
windows7-x64
7AutoSettin...le.exe
windows10-2004-x64
7AutoSettin...PO.exe
windows7-x64
1AutoSettin...PO.exe
windows10-2004-x64
1AutoSettin...64.exe
windows7-x64
3AutoSettin...64.exe
windows10-2004-x64
3AutoSettin...86.exe
windows7-x64
7AutoSettin...86.exe
windows10-2004-x64
7AutoSettin...64.exe
windows7-x64
1AutoSettin...64.exe
windows10-2004-x64
1AutoSettin...86.exe
windows7-x64
1AutoSettin...86.exe
windows10-2004-x64
1AutoSettin...ks.ps1
windows7-x64
1AutoSettin...ks.ps1
windows10-2004-x64
1AutoSettin...ho.exe
windows7-x64
7AutoSettin...ho.exe
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 03:51
Behavioral task
behavioral1
Sample
AutoSettings/Check.bat
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AutoSettings/Check.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
AutoSettings/Disable_NumLock.bat
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
AutoSettings/Disable_NumLock.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
AutoSettings/Enable_Biometrics.bat
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
AutoSettings/Enable_Biometrics.bat
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
AutoSettings/Enable_Sensors.bat
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
AutoSettings/Enable_Sensors.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
AutoSettings/Files/MySettings.bat
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
AutoSettings/Files/MySettings.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
AutoSettings/Files/Tools/7z.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
AutoSettings/Files/Tools/7z.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
AutoSettings/Files/Tools/7z.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
AutoSettings/Files/Tools/7z.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
AutoSettings/Files/Tools/ExitExplorer.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
AutoSettings/Files/Tools/ExitExplorer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
AutoSettings/Files/Tools/Handle.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
AutoSettings/Files/Tools/Handle.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
AutoSettings/Files/Tools/LGPO.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
AutoSettings/Files/Tools/LGPO.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
AutoSettings/Files/Tools/RunFromToken_x64.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
AutoSettings/Files/Tools/RunFromToken_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
AutoSettings/Files/Tools/RunFromToken_x86.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
AutoSettings/Files/Tools/RunFromToken_x86.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
AutoSettings/Files/Tools/SetACLx64.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
AutoSettings/Files/Tools/SetACLx64.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
AutoSettings/Files/Tools/SetACLx86.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
AutoSettings/Files/Tools/SetACLx86.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
AutoSettings/Files/Tools/ViewMyDisks.ps1
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
AutoSettings/Files/Tools/ViewMyDisks.ps1
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
AutoSettings/Files/Tools/cecho.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
AutoSettings/Files/Tools/cecho.exe
Resource
win10v2004-20231222-en
General
-
Target
AutoSettings/Enable_Biometrics.bat
-
Size
4KB
-
MD5
926b8c39eec5f0cc73f31b3c18619b71
-
SHA1
de8380ca4fd7b3e5dfc3f6bdfab93f69d12964bd
-
SHA256
95cbc250371fd9689c08fa08c2ce9ba17c2798adb22778a8caaf4f716d10a785
-
SHA512
a6983d57287e9a33b0919b98718565640aaa061903dd9fbaa71a55a228832d891a34ad2328855d081805df867e9a6b49ff7e1bc2111fc3b8c040a1b292f3ba1b
-
SSDEEP
96:fgexK+/VNhXhHsG2Wk0kdKarsUBiTkit5JHiR6PbebTV:IkVNfXhHsG2Wk0mKarsUApJCRUwV
Malware Config
Signatures
-
resource yara_rule behavioral6/memory/2708-1-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/2352-2-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/1296-5-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/3664-9-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/1284-10-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/3044-23-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4892-22-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4280-8-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/4908-6-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/1196-4-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral6/memory/2708-0-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy LGPO.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini LGPO.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol LGPO.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI LGPO.exe File created C:\Windows\System32\GroupPolicy\User\Registry.pol LGPO.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3700 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3968 3984 cmd.exe 88 PID 3984 wrote to memory of 3968 3984 cmd.exe 88 PID 3984 wrote to memory of 3524 3984 cmd.exe 89 PID 3984 wrote to memory of 3524 3984 cmd.exe 89 PID 3984 wrote to memory of 2708 3984 cmd.exe 90 PID 3984 wrote to memory of 2708 3984 cmd.exe 90 PID 3984 wrote to memory of 2708 3984 cmd.exe 90 PID 3984 wrote to memory of 2352 3984 cmd.exe 92 PID 3984 wrote to memory of 2352 3984 cmd.exe 92 PID 3984 wrote to memory of 2352 3984 cmd.exe 92 PID 3984 wrote to memory of 1196 3984 cmd.exe 106 PID 3984 wrote to memory of 1196 3984 cmd.exe 106 PID 3984 wrote to memory of 1196 3984 cmd.exe 106 PID 3984 wrote to memory of 1296 3984 cmd.exe 105 PID 3984 wrote to memory of 1296 3984 cmd.exe 105 PID 3984 wrote to memory of 1296 3984 cmd.exe 105 PID 3984 wrote to memory of 4908 3984 cmd.exe 104 PID 3984 wrote to memory of 4908 3984 cmd.exe 104 PID 3984 wrote to memory of 4908 3984 cmd.exe 104 PID 3984 wrote to memory of 4280 3984 cmd.exe 103 PID 3984 wrote to memory of 4280 3984 cmd.exe 103 PID 3984 wrote to memory of 4280 3984 cmd.exe 103 PID 3984 wrote to memory of 3664 3984 cmd.exe 102 PID 3984 wrote to memory of 3664 3984 cmd.exe 102 PID 3984 wrote to memory of 3664 3984 cmd.exe 102 PID 3984 wrote to memory of 3700 3984 cmd.exe 96 PID 3984 wrote to memory of 3700 3984 cmd.exe 96 PID 3984 wrote to memory of 1284 3984 cmd.exe 94 PID 3984 wrote to memory of 1284 3984 cmd.exe 94 PID 3984 wrote to memory of 1284 3984 cmd.exe 94 PID 3984 wrote to memory of 464 3984 cmd.exe 93 PID 3984 wrote to memory of 464 3984 cmd.exe 93 PID 3984 wrote to memory of 464 3984 cmd.exe 93 PID 3984 wrote to memory of 4892 3984 cmd.exe 100 PID 3984 wrote to memory of 4892 3984 cmd.exe 100 PID 3984 wrote to memory of 4892 3984 cmd.exe 100 PID 3984 wrote to memory of 3044 3984 cmd.exe 97 PID 3984 wrote to memory of 3044 3984 cmd.exe 97 PID 3984 wrote to memory of 3044 3984 cmd.exe 97
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AutoSettings\Enable_Biometrics.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:3968
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-19\Environment"2⤵PID:3524
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0b}Добавление настройки Групповой Политики в файл LGPO:{\n #}2⤵PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}"Разрешить использование биометрии" {0b}Настроить ГП!{\n #}2⤵PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\LGPO.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\LGPO.exe" /t "C:\Users\Admin\AppData\Local\Temp\LGPO-file.txt" /q2⤵
- Drops file in System32 directory
PID:464
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0b}Применение параметров из LGPO файла {08}(настройка ГП) {\n #}2⤵PID:1284
-
-
C:\Windows\system32\sc.exesc config WbioSrvc start= auto2⤵
- Launches sc.exe
PID:3700
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Перезагрузите компьютер!!! {\n #}2⤵PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Исправление выполнено {\n #}2⤵PID:4892
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}Биометрическая служба Windows "WbioSrvc"{\n #}2⤵PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Добавлен параметр в LGPO файл {08}(для настройки ГП){#}:{\n #}2⤵PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}"Включить Windows Hellow для бизнеса" {0b}Настроить ГП!{\n #}2⤵PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0b}Добавление настройки Групповой Политики в файл LGPO:{\n #}2⤵PID:1296
-
-
C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Добавлен параметр в LGPO файл {08}(для настройки ГП){#}:{\n #}2⤵PID:1196
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2232
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD5c7baae5131c75b53c18e82978ba2aa03
SHA131a97fd7321d6c016fd45320c2b91d6fcf929e0c
SHA256d6391e4cec7f6be75b897a115a529c3dc4a0991fea2bf38ac44723d9261a9946
SHA5120e44d745889411348e1353915e6bf9ae9be088537f1493f7713f17c94bacf4e15094c6855692ec13a37f04096a28b2830a6dcaa25b5ac6ff289641046bc0b507