Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 01:29

General

  • Target

    !!BEST TWEAKS/Registry _ Batch/Disable USB Powersaving.bat

  • Size

    518B

  • MD5

    d8acddee643d3140daf6da682f37d120

  • SHA1

    850731dec96cc29c2776f225cf286a65b5484cf3

  • SHA256

    710fcbc4bd41fd8649b673d3d3b582246e44465e172eb6f148d0e0e01c34e25d

  • SHA512

    95390224b68f68598e6a60782e2840fa981a8611b38577a4f06d67c1e38125923486155fb492bd9099adf993b68325ac958b13487a6d09dd10d0573719a15092

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 52 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\!!BEST TWEAKS\Registry _ Batch\Disable USB Powersaving.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnhancedPowerManagementEnabled" | findstr "HKEY"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnhancedPowerManagementEnabled"
        3⤵
        • Checks SCSI registry key(s)
        PID:3024
      • C:\Windows\system32\findstr.exe
        findstr "HKEY"
        3⤵
          PID:2612
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "AllowIdleIrpInD3" | findstr "HKEY"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\system32\reg.exe
          reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "AllowIdleIrpInD3"
          3⤵
          • Checks SCSI registry key(s)
          PID:2620
        • C:\Windows\system32\findstr.exe
          findstr "HKEY"
          3⤵
            PID:2676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnableSelectiveSuspend" | findstr "HKEY"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\system32\reg.exe
            reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnableSelectiveSuspend"
            3⤵
            • Checks SCSI registry key(s)
            PID:2696
          • C:\Windows\system32\findstr.exe
            findstr "HKEY"
            3⤵
              PID:2768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "DeviceSelectiveSuspended" | findstr "HKEY"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2852
            • C:\Windows\system32\reg.exe
              reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "DeviceSelectiveSuspended"
              3⤵
              • Checks SCSI registry key(s)
              PID:2672
            • C:\Windows\system32\findstr.exe
              findstr "HKEY"
              3⤵
                PID:2628
            • C:\Windows\system32\reg.exe
              reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1\Device Parameters" /v "DeviceSelectiveSuspended" /t REG_DWORD /d "0" /f
              2⤵
                PID:2708
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "SelectiveSuspendEnabled" | findstr "HKEY"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2652
                • C:\Windows\system32\reg.exe
                  reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "SelectiveSuspendEnabled"
                  3⤵
                  • Checks SCSI registry key(s)
                  PID:2604
                • C:\Windows\system32\findstr.exe
                  findstr "HKEY"
                  3⤵
                    PID:2476
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "SelectiveSuspendOn" | findstr "HKEY"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2328
                  • C:\Windows\system32\reg.exe
                    reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "SelectiveSuspendOn"
                    3⤵
                    • Checks SCSI registry key(s)
                    PID:2840
                  • C:\Windows\system32\findstr.exe
                    findstr "HKEY"
                    3⤵
                      PID:2632
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnumerationRetryCount" | findstr "HKEY"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2504
                    • C:\Windows\system32\reg.exe
                      reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnumerationRetryCount"
                      3⤵
                      • Checks SCSI registry key(s)
                      PID:2728
                    • C:\Windows\system32\findstr.exe
                      findstr "HKEY"
                      3⤵
                        PID:2560
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "ExtPropDescSemaphore" | findstr "HKEY"
                      2⤵
                        PID:2812
                        • C:\Windows\system32\reg.exe
                          reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "ExtPropDescSemaphore"
                          3⤵
                          • Checks SCSI registry key(s)
                          PID:2808
                        • C:\Windows\system32\findstr.exe
                          findstr "HKEY"
                          3⤵
                            PID:2704
                        • C:\Windows\system32\reg.exe
                          reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1\Device Parameters" /v "ExtPropDescSemaphore" /t REG_DWORD /d "0" /f
                          2⤵
                            PID:2496
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "WaitWakeEnabled" | findstr "HKEY"
                            2⤵
                              PID:2644
                              • C:\Windows\system32\reg.exe
                                reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "WaitWakeEnabled"
                                3⤵
                                • Checks SCSI registry key(s)
                                PID:2636
                              • C:\Windows\system32\findstr.exe
                                findstr "HKEY"
                                3⤵
                                  PID:2584
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "D3ColdSupported" | findstr "HKEY"
                                2⤵
                                  PID:2532
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "D3ColdSupported"
                                    3⤵
                                    • Checks SCSI registry key(s)
                                    PID:2468
                                  • C:\Windows\system32\findstr.exe
                                    findstr "HKEY"
                                    3⤵
                                      PID:2464
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "WdfDirectedPowerTransitionEnable" | findstr "HKEY"
                                    2⤵
                                      PID:2484
                                      • C:\Windows\system32\reg.exe
                                        reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "WdfDirectedPowerTransitionEnable"
                                        3⤵
                                        • Checks SCSI registry key(s)
                                        PID:2500
                                      • C:\Windows\system32\findstr.exe
                                        findstr "HKEY"
                                        3⤵
                                          PID:2536
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnableIdlePowerManagement" | findstr "HKEY"
                                        2⤵
                                          PID:2544
                                          • C:\Windows\system32\reg.exe
                                            reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "EnableIdlePowerManagement"
                                            3⤵
                                            • Checks SCSI registry key(s)
                                            PID:2364
                                          • C:\Windows\system32\findstr.exe
                                            findstr "HKEY"
                                            3⤵
                                              PID:2928
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "IdleInWorkingState" | findstr "HKEY"
                                            2⤵
                                              PID:2980
                                              • C:\Windows\system32\reg.exe
                                                reg query "HKLM\SYSTEM\CurrentControlSet\Enum" /s /f "IdleInWorkingState"
                                                3⤵
                                                • Checks SCSI registry key(s)
                                                PID:2528
                                              • C:\Windows\system32\findstr.exe
                                                findstr "HKEY"
                                                3⤵
                                                  PID:2320

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads