Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Beasty Cra...58.cmd
windows7-x64
1Beasty Cra...58.cmd
windows10-2004-x64
1Beasty Cra...66.cmd
windows7-x64
1Beasty Cra...66.cmd
windows10-2004-x64
1Beasty Cra...7r.bat
windows7-x64
3Beasty Cra...7r.bat
windows10-2004-x64
3Beasty Cra...7r.bat
windows7-x64
1Beasty Cra...7r.bat
windows10-2004-x64
1Beasty Cra...64.exe
windows7-x64
1Beasty Cra...64.exe
windows10-2004-x64
1Beasty Cra...64.dll
windows7-x64
1Beasty Cra...64.dll
windows10-2004-x64
1Beasty Cra...1].dll
windows7-x64
1Beasty Cra...1].dll
windows10-2004-x64
1Beasty Cra...64.sys
windows7-x64
1Beasty Cra...64.sys
windows10-2004-x64
1Beasty Cra...1].exe
windows7-x64
Beasty Cra...1].exe
windows10-2004-x64
Beasty Cra...rd.exe
windows7-x64
1Beasty Cra...rd.exe
windows10-2004-x64
1Beasty Cra...64.sys
windows7-x64
1Beasty Cra...64.sys
windows10-2004-x64
1Beasty Cra...er.exe
windows7-x64
1Beasty Cra...er.exe
windows10-2004-x64
1Analysis
-
max time kernel
1s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 14:11
Behavioral task
behavioral1
Sample
Beasty Cracked/BNY DUMPED/32158.cmd
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
Beasty Cracked/BNY DUMPED/32158.cmd
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Beasty Cracked/BNY DUMPED/366.cmd
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
Beasty Cracked/BNY DUMPED/366.cmd
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Beasty Cracked/BNY DUMPED/8fferszesf7r.bat
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
Beasty Cracked/BNY DUMPED/8fferszesf7r.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Beasty Cracked/BNY DUMPED/8fzqf7r.bat
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
Beasty Cracked/BNY DUMPED/8fzqf7r.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Beasty Cracked/BNY DUMPED/AMIDEWINx64.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
Beasty Cracked/BNY DUMPED/AMIDEWINx64.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Beasty Cracked/BNY DUMPED/SecureEngineSDK64.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
Beasty Cracked/BNY DUMPED/SecureEngineSDK64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Beasty Cracked/BNY DUMPED/SecureEngineSDK64[1].dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Beasty Cracked/BNY DUMPED/SecureEngineSDK64[1].dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Beasty Cracked/BNY DUMPED/amifldrv64.sys
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
Beasty Cracked/BNY DUMPED/amifldrv64.sys
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Beasty Cracked/BNY DUMPED/cup_asus[1].exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Beasty Cracked/BNY DUMPED/cup_asus[1].exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Beasty Cracked/BNY DUMPED/retard.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral20
Sample
Beasty Cracked/BNY DUMPED/retard.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Beasty Cracked/BNY DUMPED/sefdebos64.sys
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
Beasty Cracked/BNY DUMPED/sefdebos64.sys
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Beasty Cracked/beasty spoofer.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral24
Sample
Beasty Cracked/beasty spoofer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
Beasty Cracked/BNY DUMPED/366.cmd
-
Size
2KB
-
MD5
875a54f511baf4bc25c5cc2e4d56c1a0
-
SHA1
57bb04b6bb812f5bdff40a5bc324a17771145918
-
SHA256
d80a0db16a6a3ba969ead9957c04e3ca6cdb05dbdea48d0cb49269c8e24867e1
-
SHA512
8600c555a7c995076d7d71903b3fb6494e9c8f5c1cb49aaabec92200a4e8e2fb4f30fb8aa85e214e7a4b9a7c04453e821097ee873d0383d6b1a40719b59f470c
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4960 WMIC.exe Token: SeSecurityPrivilege 4960 WMIC.exe Token: SeTakeOwnershipPrivilege 4960 WMIC.exe Token: SeLoadDriverPrivilege 4960 WMIC.exe Token: SeSystemProfilePrivilege 4960 WMIC.exe Token: SeSystemtimePrivilege 4960 WMIC.exe Token: SeProfSingleProcessPrivilege 4960 WMIC.exe Token: SeIncBasePriorityPrivilege 4960 WMIC.exe Token: SeCreatePagefilePrivilege 4960 WMIC.exe Token: SeBackupPrivilege 4960 WMIC.exe Token: SeRestorePrivilege 4960 WMIC.exe Token: SeShutdownPrivilege 4960 WMIC.exe Token: SeDebugPrivilege 4960 WMIC.exe Token: SeSystemEnvironmentPrivilege 4960 WMIC.exe Token: SeRemoteShutdownPrivilege 4960 WMIC.exe Token: SeUndockPrivilege 4960 WMIC.exe Token: SeManageVolumePrivilege 4960 WMIC.exe Token: 33 4960 WMIC.exe Token: 34 4960 WMIC.exe Token: 35 4960 WMIC.exe Token: 36 4960 WMIC.exe Token: SeIncreaseQuotaPrivilege 4960 WMIC.exe Token: SeSecurityPrivilege 4960 WMIC.exe Token: SeTakeOwnershipPrivilege 4960 WMIC.exe Token: SeLoadDriverPrivilege 4960 WMIC.exe Token: SeSystemProfilePrivilege 4960 WMIC.exe Token: SeSystemtimePrivilege 4960 WMIC.exe Token: SeProfSingleProcessPrivilege 4960 WMIC.exe Token: SeIncBasePriorityPrivilege 4960 WMIC.exe Token: SeCreatePagefilePrivilege 4960 WMIC.exe Token: SeBackupPrivilege 4960 WMIC.exe Token: SeRestorePrivilege 4960 WMIC.exe Token: SeShutdownPrivilege 4960 WMIC.exe Token: SeDebugPrivilege 4960 WMIC.exe Token: SeSystemEnvironmentPrivilege 4960 WMIC.exe Token: SeRemoteShutdownPrivilege 4960 WMIC.exe Token: SeUndockPrivilege 4960 WMIC.exe Token: SeManageVolumePrivilege 4960 WMIC.exe Token: 33 4960 WMIC.exe Token: 34 4960 WMIC.exe Token: 35 4960 WMIC.exe Token: 36 4960 WMIC.exe Token: SeIncreaseQuotaPrivilege 3488 WMIC.exe Token: SeSecurityPrivilege 3488 WMIC.exe Token: SeTakeOwnershipPrivilege 3488 WMIC.exe Token: SeLoadDriverPrivilege 3488 WMIC.exe Token: SeSystemProfilePrivilege 3488 WMIC.exe Token: SeSystemtimePrivilege 3488 WMIC.exe Token: SeProfSingleProcessPrivilege 3488 WMIC.exe Token: SeIncBasePriorityPrivilege 3488 WMIC.exe Token: SeCreatePagefilePrivilege 3488 WMIC.exe Token: SeBackupPrivilege 3488 WMIC.exe Token: SeRestorePrivilege 3488 WMIC.exe Token: SeShutdownPrivilege 3488 WMIC.exe Token: SeDebugPrivilege 3488 WMIC.exe Token: SeSystemEnvironmentPrivilege 3488 WMIC.exe Token: SeRemoteShutdownPrivilege 3488 WMIC.exe Token: SeUndockPrivilege 3488 WMIC.exe Token: SeManageVolumePrivilege 3488 WMIC.exe Token: 33 3488 WMIC.exe Token: 34 3488 WMIC.exe Token: 35 3488 WMIC.exe Token: 36 3488 WMIC.exe Token: SeIncreaseQuotaPrivilege 3488 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1932 1284 cmd.exe 86 PID 1284 wrote to memory of 1932 1284 cmd.exe 86 PID 1284 wrote to memory of 2296 1284 cmd.exe 89 PID 1284 wrote to memory of 2296 1284 cmd.exe 89 PID 2296 wrote to memory of 4960 2296 cmd.exe 90 PID 2296 wrote to memory of 4960 2296 cmd.exe 90 PID 2296 wrote to memory of 2432 2296 cmd.exe 91 PID 2296 wrote to memory of 2432 2296 cmd.exe 91 PID 1284 wrote to memory of 4836 1284 cmd.exe 93 PID 1284 wrote to memory of 4836 1284 cmd.exe 93 PID 1284 wrote to memory of 872 1284 cmd.exe 94 PID 1284 wrote to memory of 872 1284 cmd.exe 94 PID 1284 wrote to memory of 452 1284 cmd.exe 95 PID 1284 wrote to memory of 452 1284 cmd.exe 95 PID 1284 wrote to memory of 3968 1284 cmd.exe 97 PID 1284 wrote to memory of 3968 1284 cmd.exe 97 PID 1284 wrote to memory of 2608 1284 cmd.exe 98 PID 1284 wrote to memory of 2608 1284 cmd.exe 98 PID 2608 wrote to memory of 3488 2608 cmd.exe 99 PID 2608 wrote to memory of 3488 2608 cmd.exe 99 PID 2608 wrote to memory of 4816 2608 cmd.exe 100 PID 2608 wrote to memory of 4816 2608 cmd.exe 100 PID 1284 wrote to memory of 2108 1284 cmd.exe 101 PID 1284 wrote to memory of 2108 1284 cmd.exe 101 PID 1284 wrote to memory of 3308 1284 cmd.exe 102 PID 1284 wrote to memory of 3308 1284 cmd.exe 102 PID 1284 wrote to memory of 4256 1284 cmd.exe 103 PID 1284 wrote to memory of 4256 1284 cmd.exe 103 PID 1284 wrote to memory of 1584 1284 cmd.exe 104 PID 1284 wrote to memory of 1584 1284 cmd.exe 104 PID 1284 wrote to memory of 4412 1284 cmd.exe 105 PID 1284 wrote to memory of 4412 1284 cmd.exe 105 PID 4412 wrote to memory of 1924 4412 cmd.exe 107 PID 4412 wrote to memory of 1924 4412 cmd.exe 107 PID 1284 wrote to memory of 1820 1284 cmd.exe 108 PID 1284 wrote to memory of 1820 1284 cmd.exe 108 PID 1284 wrote to memory of 1932 1284 cmd.exe 86 PID 1284 wrote to memory of 1932 1284 cmd.exe 86 PID 1284 wrote to memory of 2296 1284 cmd.exe 89 PID 1284 wrote to memory of 2296 1284 cmd.exe 89 PID 2296 wrote to memory of 4960 2296 cmd.exe 90 PID 2296 wrote to memory of 4960 2296 cmd.exe 90 PID 2296 wrote to memory of 2432 2296 cmd.exe 91 PID 2296 wrote to memory of 2432 2296 cmd.exe 91 PID 1284 wrote to memory of 4836 1284 cmd.exe 93 PID 1284 wrote to memory of 4836 1284 cmd.exe 93 PID 1284 wrote to memory of 872 1284 cmd.exe 94 PID 1284 wrote to memory of 872 1284 cmd.exe 94 PID 1284 wrote to memory of 452 1284 cmd.exe 95 PID 1284 wrote to memory of 452 1284 cmd.exe 95 PID 1284 wrote to memory of 3968 1284 cmd.exe 97 PID 1284 wrote to memory of 3968 1284 cmd.exe 97 PID 1284 wrote to memory of 2608 1284 cmd.exe 98 PID 1284 wrote to memory of 2608 1284 cmd.exe 98 PID 2608 wrote to memory of 3488 2608 cmd.exe 99 PID 2608 wrote to memory of 3488 2608 cmd.exe 99 PID 2608 wrote to memory of 4816 2608 cmd.exe 100 PID 2608 wrote to memory of 4816 2608 cmd.exe 100 PID 1284 wrote to memory of 2108 1284 cmd.exe 101 PID 1284 wrote to memory of 2108 1284 cmd.exe 101 PID 1284 wrote to memory of 3308 1284 cmd.exe 102 PID 1284 wrote to memory of 3308 1284 cmd.exe 102 PID 1284 wrote to memory of 4256 1284 cmd.exe 103 PID 1284 wrote to memory of 4256 1284 cmd.exe 103
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Beasty Cracked\BNY DUMPED\366.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\system32\getmac.exegetmac2⤵PID:1932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2432
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:4836
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:872
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:452
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d EA97B6F52FA5 /f2⤵PID:3968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:4816
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:2108
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:3308
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4256
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:1584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:1924
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵PID:1820
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:860