Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
instant_death.bat
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
instant_death.bat
Resource
win10v2004-20240508-en
General
-
Target
instant_death.bat
-
Size
436B
-
MD5
b0799a62c132c37b9f28cef7a80550b4
-
SHA1
5abdb7fc08c0b319ff9fea4f0ec471eb24f0af05
-
SHA256
309a825d05db113903e7d65bc2b9335f76d1c95f80a7492c3aee1999a47dc2ee
-
SHA512
32fd6ba592b57dd73758aa3b249cf5c5764e36c68e23cbd4ff2b5b3471a5d47057085f149f5b6b949560016afb33e020446a17647493969a070f7fe9595a0586
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3700 firefox.exe Token: SeDebugPrivilege 3700 firefox.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3700 firefox.exe 3700 firefox.exe 3700 firefox.exe 3700 firefox.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3700 firefox.exe 3700 firefox.exe 3700 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3700 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 2068 3632 cmd.exe 84 PID 3632 wrote to memory of 2068 3632 cmd.exe 84 PID 3632 wrote to memory of 2960 3632 cmd.exe 85 PID 3632 wrote to memory of 2960 3632 cmd.exe 85 PID 3632 wrote to memory of 1916 3632 cmd.exe 100 PID 3632 wrote to memory of 1916 3632 cmd.exe 100 PID 3868 wrote to memory of 1592 3868 msedge.exe 103 PID 3868 wrote to memory of 1592 3868 msedge.exe 103 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 3464 3868 msedge.exe 104 PID 3868 wrote to memory of 1068 3868 msedge.exe 105 PID 3868 wrote to memory of 1068 3868 msedge.exe 105 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 PID 3868 wrote to memory of 2116 3868 msedge.exe 106 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\instant_death.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\manage-bde.exemanage-bde -on C: -Force2⤵PID:2068
-
-
C:\Windows\system32\manage-bde.exemanage-bde -on D: -Force2⤵PID:2960
-
-
C:\Windows\system32\msg.exemsg * "Say goodbye to your PC!"2⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff387d46f8,0x7fff387d4708,0x7fff387d47182⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,9485824141951654426,9561539014712448255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,9485824141951654426,9561539014712448255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,9485824141951654426,9561539014712448255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9485824141951654426,9561539014712448255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,9485824141951654426,9561539014712448255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:4072
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4428
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1568
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:3660
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3700 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.0.786325582\1601083687" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13c5531a-b722-49a1-8cd4-1fdbea7a04fc} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 1852 2e047525b58 gpu3⤵PID:4636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.1.803525896\661757163" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {788cc43c-942e-4cd7-bf57-c7c9af3c6296} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 2420 2e03a788d58 socket3⤵
- Checks processor information in registry
PID:4860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.2.1839063038\904810607" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bfb22c0-07dc-43ad-89f8-aca9a8846275} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 2940 2e046594958 tab3⤵PID:5016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3700.3.1963724942\1567962126" -childID 2 -isForBrowser -prefsHandle 3752 -prefMapHandle 3744 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51ac1fb9-3622-4036-a3fb-c5b50a832fa8} 3700 "\\.\pipe\gecko-crash-server-pipe.3700" 3768 2e04c306858 tab3⤵PID:3188
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
5KB
MD5654d4cd9c8f50db65cd74ca1e90b81b6
SHA15adea27967869378027eac86eb5ae5d5ccd7c467
SHA256e02e1bff65752027526647f02e5f7de89ea3d4b322c0b7a14f72a98c47e81faa
SHA5127d7e4f7a954e0f7cc0b09c17a94724d6ae55871e60ba0f981202a178f79f2bb24173d2c56f7c576fb55c1411314f2cb1bd7f55d3b9cf084d625c1ef16a1b334a
-
Filesize
6KB
MD583401a1c205615404c54b6af4c247d4f
SHA1dd6d799b43f07a50f9fdbc3c9f057240c4df292e
SHA256ecc7b0b3de07d9fce954a21d57c6dfefa6c25bc9fe8b6455d57a3b4a53abb6e8
SHA512ee71bcb7c2b6a33d92f87bef22e9e6b7fa306fda9678ee5dcf359cf360ebd07b70eb1c363dbc20276a5f18fff187f121966fb83d9f5459102ab96fa0db1ec818
-
Filesize
11KB
MD5bd5ede841ed9ddc896b4f6b7fbf57c36
SHA12fc6b961a1a5fd637bc537b6e46a4b911004530c
SHA256ec42774d5980a8698d7bd1e0d0e7fa5b4a861e538d64ff27a68ab89537f58ff9
SHA512e002b88b579db03a2e952bbbe848ba339bc6f00a60b01c6ff102280c99bbe0747e7c9b59e211fadc81bc970fd7c1cab0a075600b23082aaf2ae2f2ef4c7d3407
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\activity-stream.discovery_stream.json.tmp
Filesize26KB
MD59598db641d759acdf413e77545139b46
SHA1983ed9cd58d05938d075fc728b52371ce6eb01ec
SHA25649cbd0a5adc1419c3f23099f1c17a0203343f3af77d02d296f00bd305caf1ca8
SHA51268f0e0e2ac81bc9b5709bbeb06b0bec441ad16802f2ee741f5797496d227358b1d3dee85b5fcab584d59ee8e141960e3a8ad941785fe2f9d6cd91b89cb606a95
-
Filesize
6KB
MD56e80f7a09f8c04a7e009ef2d7a656d4c
SHA1325b4a961cee362cfa07cfc3c6c387923fe550a1
SHA25638e478288daf913fe0ca37fcad5e53c30c089fd32d3809c9f0c1d8ee7edbd7d2
SHA5123d7bc78d2f51b92ddb1b4d77fcef76d8ae1bac42aaaef8b3aa0ee2a92e9001290ba16e670ebe9bbcdc1d53177e937ead6f469c1696388e068225a38d2f6b6f4f
-
Filesize
6KB
MD5fa8cc1c4d3ae1663a6f4866ed65d64af
SHA1fda7c46733ac97710498597851b414dbf438ed8d
SHA256262cd904d410fa41b7bf31aa2af5ef2222210527787562671f225ee5f188b4e8
SHA512bee6d5af78e95ae5988f8a2442de1769c77a509c3a4b32bf8d0982395b17c2cec54f3df2979af2a302821081b42849630760b75338d85c04b3ddcb1080b4b252
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\sessionstore.jsonlz4
Filesize905B
MD54adf3683c7e5204c7ff02018c69a1b7f
SHA1c73c765a67380971314646082716bae1761dc1bd
SHA256fa9456d0ac05b56d342fcdb6524f0e8f297c2ddf4c316a696ecf7b64f093f6d7
SHA512d7b5fa3373e740e94f346271bac622daa04a1d257a648d688b51834ef18e207e60dc914311a2e93c3382cccdda60289d24107ed1d2fdcb92cdd179e384ff8f6c