Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
sunnyeitatet.bat
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
sunnyeitatet.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
sunnyeitatet.bat
-
Size
999B
-
MD5
cb9764285d399fce12332ed84fde94ef
-
SHA1
6a6232ab2215c03b824740e6862b94877e71f5fc
-
SHA256
4b5209ab46fa0523d376f0a0ba3dd24a91c76eff3fc2d72f2371186a3b24abe2
-
SHA512
dbca31dfd1364954b8af7575a3190e17309bd5c5767e9c7f0e4fae10dc0e1eae9a8de104642c990a59ac4b294ff5e53731fcebaa0324813ac91622e62691d9b9
Score
1/10
Malware Config
Signatures
-
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 2992 NETSTAT.EXE 2968 NETSTAT.EXE 2000 NETSTAT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2176 vlc.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1508 tskill.exe 1508 tskill.exe 2612 tskill.exe 2612 tskill.exe 2628 tskill.exe 2628 tskill.exe 2264 tskill.exe 2264 tskill.exe 2068 tskill.exe 2068 tskill.exe 2780 tskill.exe 2780 tskill.exe 2672 tskill.exe 2672 tskill.exe 2716 tskill.exe 2716 tskill.exe 2900 tskill.exe 2900 tskill.exe 2492 tskill.exe 2492 tskill.exe 2912 tskill.exe 2912 tskill.exe 2764 tskill.exe 2764 tskill.exe 2784 tskill.exe 2784 tskill.exe 2760 tskill.exe 2760 tskill.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2176 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2992 NETSTAT.EXE Token: SeDebugPrivilege 2968 NETSTAT.EXE Token: SeDebugPrivilege 2000 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe 2176 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2176 vlc.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1508 2436 cmd.exe 29 PID 2436 wrote to memory of 1508 2436 cmd.exe 29 PID 2436 wrote to memory of 1508 2436 cmd.exe 29 PID 2436 wrote to memory of 2900 2436 cmd.exe 31 PID 2436 wrote to memory of 2900 2436 cmd.exe 31 PID 2436 wrote to memory of 2900 2436 cmd.exe 31 PID 2436 wrote to memory of 2492 2436 cmd.exe 32 PID 2436 wrote to memory of 2492 2436 cmd.exe 32 PID 2436 wrote to memory of 2492 2436 cmd.exe 32 PID 2436 wrote to memory of 2068 2436 cmd.exe 33 PID 2436 wrote to memory of 2068 2436 cmd.exe 33 PID 2436 wrote to memory of 2068 2436 cmd.exe 33 PID 2436 wrote to memory of 2612 2436 cmd.exe 36 PID 2436 wrote to memory of 2612 2436 cmd.exe 36 PID 2436 wrote to memory of 2612 2436 cmd.exe 36 PID 2436 wrote to memory of 2628 2436 cmd.exe 38 PID 2436 wrote to memory of 2628 2436 cmd.exe 38 PID 2436 wrote to memory of 2628 2436 cmd.exe 38 PID 2436 wrote to memory of 2716 2436 cmd.exe 40 PID 2436 wrote to memory of 2716 2436 cmd.exe 40 PID 2436 wrote to memory of 2716 2436 cmd.exe 40 PID 2436 wrote to memory of 2764 2436 cmd.exe 43 PID 2436 wrote to memory of 2764 2436 cmd.exe 43 PID 2436 wrote to memory of 2764 2436 cmd.exe 43 PID 2436 wrote to memory of 2780 2436 cmd.exe 44 PID 2436 wrote to memory of 2780 2436 cmd.exe 44 PID 2436 wrote to memory of 2780 2436 cmd.exe 44 PID 2436 wrote to memory of 2672 2436 cmd.exe 45 PID 2436 wrote to memory of 2672 2436 cmd.exe 45 PID 2436 wrote to memory of 2672 2436 cmd.exe 45 PID 2436 wrote to memory of 2912 2436 cmd.exe 47 PID 2436 wrote to memory of 2912 2436 cmd.exe 47 PID 2436 wrote to memory of 2912 2436 cmd.exe 47 PID 2436 wrote to memory of 2760 2436 cmd.exe 48 PID 2436 wrote to memory of 2760 2436 cmd.exe 48 PID 2436 wrote to memory of 2760 2436 cmd.exe 48 PID 2436 wrote to memory of 2784 2436 cmd.exe 49 PID 2436 wrote to memory of 2784 2436 cmd.exe 49 PID 2436 wrote to memory of 2784 2436 cmd.exe 49 PID 2436 wrote to memory of 2264 2436 cmd.exe 50 PID 2436 wrote to memory of 2264 2436 cmd.exe 50 PID 2436 wrote to memory of 2264 2436 cmd.exe 50 PID 2436 wrote to memory of 2136 2436 cmd.exe 59 PID 2436 wrote to memory of 2136 2436 cmd.exe 59 PID 2436 wrote to memory of 2136 2436 cmd.exe 59 PID 2436 wrote to memory of 3028 2436 cmd.exe 60 PID 2436 wrote to memory of 3028 2436 cmd.exe 60 PID 2436 wrote to memory of 3028 2436 cmd.exe 60 PID 2436 wrote to memory of 2536 2436 cmd.exe 61 PID 2436 wrote to memory of 2536 2436 cmd.exe 61 PID 2436 wrote to memory of 2536 2436 cmd.exe 61 PID 2436 wrote to memory of 2992 2436 cmd.exe 62 PID 2436 wrote to memory of 2992 2436 cmd.exe 62 PID 2436 wrote to memory of 2992 2436 cmd.exe 62 PID 2436 wrote to memory of 2968 2436 cmd.exe 63 PID 2436 wrote to memory of 2968 2436 cmd.exe 63 PID 2436 wrote to memory of 2968 2436 cmd.exe 63 PID 2436 wrote to memory of 2000 2436 cmd.exe 64 PID 2436 wrote to memory of 2000 2436 cmd.exe 64 PID 2436 wrote to memory of 2000 2436 cmd.exe 64 PID 2436 wrote to memory of 2040 2436 cmd.exe 65 PID 2436 wrote to memory of 2040 2436 cmd.exe 65 PID 2436 wrote to memory of 2040 2436 cmd.exe 65
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sunnyeitatet.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2716
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\Windows\system32\tskill.exetskill explorer2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264
-
-
C:\Windows\system32\tree.comTree2⤵PID:2136
-
-
C:\Windows\system32\tree.comTree2⤵PID:3028
-
-
C:\Windows\system32\tree.comTree2⤵PID:2536
-
-
C:\Windows\system32\NETSTAT.EXENetstat -n2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\system32\NETSTAT.EXENetstat -n2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\system32\NETSTAT.EXENetstat -n2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\system32\driverquery.exeDriverquery2⤵PID:2040
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SendRename.mp4v"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2176