Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 18:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Launcher.bat
Resource
win10v2004-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
lua51.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
luajit.exe
Resource
win10v2004-20240508-en
0 signatures
150 seconds
General
-
Target
Launcher.bat
-
Size
724B
-
MD5
9edcc8710e562b5daeed73acaa17e2fd
-
SHA1
a3d7d0a26c3a058ff0b3a25c64d43397f1823d95
-
SHA256
f1ed443faa01092320e04e0231327bd59c6df7344ad0f46ca4885d28aa2afd60
-
SHA512
312fec45d3897ecc67285694a73d4fc7ef044b6f3aa1e6a9d5a8cee0b1b70204396b43fe014a4680c539427c070f199ff91f151fbdc2ae8e0d97f1b3fca3cb4a
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1896 wrote to memory of 3212 1896 cmd.exe 90 PID 1896 wrote to memory of 3212 1896 cmd.exe 90 PID 1896 wrote to memory of 728 1896 cmd.exe 91 PID 1896 wrote to memory of 728 1896 cmd.exe 91 PID 1896 wrote to memory of 728 1896 cmd.exe 91
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:3212
-
-
C:\Users\Admin\AppData\Local\Temp\luajit.exeluajit.exe conf2⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:4852