Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1385s -
max time network
1166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
funny.bat
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
funny.bat
Resource
win10v2004-20240419-en
General
-
Target
funny.bat
-
Size
4KB
-
MD5
bc2b5d3f039dce8f8598ffcfae1bbd54
-
SHA1
129e2f3420d754b8b7ea26c75dfc6f20668ad932
-
SHA256
ab59e6fa326cad0882883058bf6cc63b960881f3a8dbe8b19fda6fcc6e7cf2e2
-
SHA512
7214de1033ddb95c92a525aa288c794c8b7cec27d2290bb27e0ba2765ae00d9a61d77d64efd495237e0f322bc301ea5be76d20a1ddc2bc8040c92df04450b9b9
-
SSDEEP
96:EIHBKYKSKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKYKm:nHBX5XXXXXXXXXXXXXXXXXXXXXXXXXXB
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1768 msedge.exe 1768 msedge.exe 3152 msedge.exe 3152 msedge.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3656 taskmgr.exe Token: SeSystemProfilePrivilege 3656 taskmgr.exe Token: SeCreateGlobalPrivilege 3656 taskmgr.exe Token: 33 3656 taskmgr.exe Token: SeIncBasePriorityPrivilege 3656 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe 3656 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 2892 3152 msedge.exe 105 PID 3152 wrote to memory of 2892 3152 msedge.exe 105 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 4468 3152 msedge.exe 106 PID 3152 wrote to memory of 1768 3152 msedge.exe 107 PID 3152 wrote to memory of 1768 3152 msedge.exe 107 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108 PID 3152 wrote to memory of 3580 3152 msedge.exe 108
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\funny.bat"1⤵PID:1164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd23746f8,0x7fffd2374708,0x7fffd23747182⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1952079828596790562,8336481100535666836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:4380
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1516
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
Filesize
6KB
MD55627ed7c3875f0ea784085ca99894726
SHA174fcd9aa3cc55fccb5420f8ce116e1dc9d242555
SHA25635a906f82e815adf3d90cc94e2fdb936ee8695370bcd32dd4272770c6c27ffb8
SHA512d21e26257d56317ff82e1c8f799f523e35684be48cd1780202af891ef8187b9fb98a2e1a05cb75489d8103fbdea3552243258ee0d3f2228b82dbbc33c0cfc6e8
-
Filesize
5KB
MD5ce75e5809e7245e94b323b167782a38f
SHA10ebb17f397c8b4984439f03535a5e33b729b60fe
SHA256b1c23ed9514edace7cdeb6e2e7345722994f240a109f5777f3d112da7f23b65e
SHA512639608ad5d068bbf4d680d1390516ac4f6a77abc4344c3c9c69469dc3b9d9d0bb65a6a8716115f1a879e8e1e83c77dc6ad2626c7c674370a3dae0ec0df53655a
-
Filesize
11KB
MD5b8960c92d923193b47505d5aa531824b
SHA1b4f004eecb15b4c9d5ac0ed30b81e8cca555d4c3
SHA256ed9c1f14b602985948c2488a1859e2d73e680e95e74c2bdc2df9b2aaf4bdf6f6
SHA5120ec6602ad3ec98f69949cb35b487f0b49961a53caae5317528185ffc3f76fc45672938b878aee54eacfe25a2ddbe535da11fdd7dac9ff23575e9c80055e1ed82
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58