Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
547s -
max time network
1591s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06/06/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
fun.bat
Resource
win10-20240404-en
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
fun.bat
Resource
win11-20240508-en
2 signatures
1800 seconds
General
-
Target
fun.bat
-
Size
265B
-
MD5
72f77463285e6b7a746ad399225f4531
-
SHA1
e775ca674e0a9c2629605bd10cf07a891563f63e
-
SHA256
c7ccce16852b76e0624ea78fcb03fc116c2f6df777782ea73bfd0651464ef6fa
-
SHA512
8a9bd7c1dd58d50b9b6807a1d031089d42c19527d5cb41cc30e4d515905395eff2bbe78ef736bb77eae121b4bed77f4e1aa86dd832dff1d656465065ba729c86
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1960 1060 cmd.exe 73 PID 1060 wrote to memory of 1960 1060 cmd.exe 73 PID 1060 wrote to memory of 1508 1060 cmd.exe 74 PID 1060 wrote to memory of 1508 1060 cmd.exe 74 PID 1060 wrote to memory of 2524 1060 cmd.exe 75 PID 1060 wrote to memory of 2524 1060 cmd.exe 75 PID 1060 wrote to memory of 2384 1060 cmd.exe 76 PID 1060 wrote to memory of 2384 1060 cmd.exe 76 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 2524 attrib.exe 2384 attrib.exe 1960 attrib.exe 1508 attrib.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fun.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\attrib.exeattrib -r -s -h C:\autoexec.bat2⤵
- Views/modifies file attributes
PID:1960
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h C:\boot.ini2⤵
- Views/modifies file attributes
PID:1508
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h C:\ntldr2⤵
- Views/modifies file attributes
PID:2524
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h C:\window\win.ini2⤵
- Views/modifies file attributes
PID:2384
-