Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
ENDER.bat
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ENDER.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ENDER.bat
-
Size
49B
-
MD5
afa3eb6fc473003b202265691e824676
-
SHA1
b9a6e1262784e63df3d206d0b920ad60ad079bbe
-
SHA256
e5a124bd1001f4fd1ab9b3cfa4a541d548d9bf23ccbe371efc950f79fb3bc3ba
-
SHA512
c196716b7ac5216286281d4cf50e897bdac46155f27d03ae7b73cde40b804f5b7f7ccc359a070d0a2e858fdff1237f7ba32c716ae4663b2d5d6d749b3119b1bf
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4780 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3152 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3152 taskmgr.exe Token: SeSystemProfilePrivilege 3152 taskmgr.exe Token: SeCreateGlobalPrivilege 3152 taskmgr.exe Token: 33 3152 taskmgr.exe Token: SeIncBasePriorityPrivilege 3152 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
pid Process 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe 3152 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ENDER.bat"1⤵PID:1680
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3152
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\b.bat1⤵
- Opens file in notepad (likely ransom note)
PID:4780
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:2452
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:4984
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:2404
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:884
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:1924
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:1016
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\b.bat" "1⤵PID:4040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD591c717cf227fe21ac19afb5ecd14af66
SHA150d926b630986080f40112ea4e03118235a3d498
SHA256d132e22dd503c324b955f3009f95991e2cc177eb39f04c7a069201589ab86189
SHA512f0e5fe16147a3676a978c03ed6e6c6d3ea63751fc63109b99e6d882efd83d342fad2957ec3176a7750483d318d2ed1a77be623fbfab29a41592aadff4604d1fb