Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
Iloveyoutest.bat
Resource
win7-20240221-en
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Iloveyoutest.bat
Resource
win10v2004-20240419-en
4 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
-
Target
Iloveyoutest.bat
-
Size
328B
-
MD5
a8829f1a59ddc6a18a6e0c69e9b1ca9b
-
SHA1
e622f83d445ed6a3af72f9ed43ec2f1c6bcc3898
-
SHA256
9a7bd4caeb6c20f3c7d7bf3c255707c458c42e42efb0a3d8daf5989474509563
-
SHA512
36f87dbcd09a29f5a8e65494fcabf1111cd4001c641076c666633e1bc320ec19364fedfe08af8e2369c6e5926183323a85435743e03d166237220b9283ace66d
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2372 shutdown.exe Token: SeRemoteShutdownPrivilege 2372 shutdown.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2372 1720 cmd.exe 29 PID 1720 wrote to memory of 2372 1720 cmd.exe 29 PID 1720 wrote to memory of 2372 1720 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Iloveyoutest.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\shutdown.exeshutdown -s -t 502⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2980
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2632