Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/07/2024, 05:55

240703-gml8yazgne 1

03/07/2024, 05:52

240703-gkytystgrk 5

Analysis

  • max time kernel
    27s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 05:55

General

  • Target

    voris.bat

  • Size

    1KB

  • MD5

    ad7217bf878a2fa8efdf11016f36070f

  • SHA1

    e49a08f35b9f226bcbea78e1bfbe688d0defc545

  • SHA256

    7693e0c9f20b5f90ebf95bbb807bb605ea0aa92f7fa30e4fd3d3d857db492dba

  • SHA512

    5d9bba18ba248b7fcaba4a5a8426f2bd881cceb241983950086f0e6e06d639d7f8fb32ab45e6635768d774a523f0fcbe66b169070469111ef451d692cdfc66cc

Score
1/10

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\voris.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\batch.bat admin"
      2⤵
        PID:2936
    • C:\Windows\System32\NOTEPAD.EXE
      "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:2576

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads