Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Cleaners/a...er.exe
windows7-x64
9Cleaners/a...er.exe
windows10-2004-x64
9Cleaners/a...rm.exe
windows7-x64
7Cleaners/a...rm.exe
windows10-2004-x64
7Cleaners/clean1.bat
windows7-x64
7Cleaners/clean1.bat
windows10-2004-x64
5Cleaners/clean2.bat
windows7-x64
7Cleaners/clean2.bat
windows10-2004-x64
4Cleaners/clean3.bat
windows7-x64
1Cleaners/clean3.bat
windows10-2004-x64
1Cleaners/clean4.bat
windows7-x64
1Cleaners/clean4.bat
windows10-2004-x64
1Cleaners/clean5.bat
windows7-x64
7Cleaners/clean5.bat
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:24
Behavioral task
behavioral1
Sample
Cleaners/applecleaner.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cleaners/applecleaner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Cleaners/applecperm.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Cleaners/applecperm.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Cleaners/clean1.bat
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Cleaners/clean1.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Cleaners/clean2.bat
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Cleaners/clean2.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Cleaners/clean3.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Cleaners/clean3.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Cleaners/clean4.bat
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Cleaners/clean4.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Cleaners/clean5.bat
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Cleaners/clean5.bat
Resource
win10v2004-20240709-en
General
-
Target
Cleaners/clean4.bat
-
Size
853KB
-
MD5
d4c34b33b42ce1a0aa1227fa3a768124
-
SHA1
796606e45d27fd332c6143f6f09cef3c8a522493
-
SHA256
d2f5b505cd5a6baaabb9d1f51f6b5800139034db44e220f83b44cd66b3197b38
-
SHA512
33ffd3944bfe182cfcd9f40bb73af997db37692f6a769953e931af24acbebaa2a698254860fc2095cd507d84a2437907016cc8d1bd3614cf6899f6428ef86ff1
-
SSDEEP
6144:5tJVSIIgunYMX7GmOgDsMrODuUpW/kBkOR1:X6IIgunYMKmOgDsMrODuUpW/kBkOR1
Malware Config
Signatures
-
Kills process with taskkill 11 IoCs
pid Process 2992 taskkill.exe 2364 taskkill.exe 2240 taskkill.exe 2848 taskkill.exe 2348 taskkill.exe 2856 taskkill.exe 2884 taskkill.exe 2652 taskkill.exe 2732 taskkill.exe 2628 taskkill.exe 2320 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2240 taskkill.exe Token: SeDebugPrivilege 2320 taskkill.exe Token: SeDebugPrivilege 2848 taskkill.exe Token: SeDebugPrivilege 2992 taskkill.exe Token: SeDebugPrivilege 2348 taskkill.exe Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: SeDebugPrivilege 2652 taskkill.exe Token: SeDebugPrivilege 2364 taskkill.exe Token: SeDebugPrivilege 2732 taskkill.exe Token: SeDebugPrivilege 2628 taskkill.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2240 2428 cmd.exe 32 PID 2428 wrote to memory of 2240 2428 cmd.exe 32 PID 2428 wrote to memory of 2240 2428 cmd.exe 32 PID 2428 wrote to memory of 2320 2428 cmd.exe 34 PID 2428 wrote to memory of 2320 2428 cmd.exe 34 PID 2428 wrote to memory of 2320 2428 cmd.exe 34 PID 2428 wrote to memory of 2848 2428 cmd.exe 35 PID 2428 wrote to memory of 2848 2428 cmd.exe 35 PID 2428 wrote to memory of 2848 2428 cmd.exe 35 PID 2428 wrote to memory of 2992 2428 cmd.exe 36 PID 2428 wrote to memory of 2992 2428 cmd.exe 36 PID 2428 wrote to memory of 2992 2428 cmd.exe 36 PID 2428 wrote to memory of 2348 2428 cmd.exe 37 PID 2428 wrote to memory of 2348 2428 cmd.exe 37 PID 2428 wrote to memory of 2348 2428 cmd.exe 37 PID 2428 wrote to memory of 2856 2428 cmd.exe 38 PID 2428 wrote to memory of 2856 2428 cmd.exe 38 PID 2428 wrote to memory of 2856 2428 cmd.exe 38 PID 2428 wrote to memory of 2884 2428 cmd.exe 39 PID 2428 wrote to memory of 2884 2428 cmd.exe 39 PID 2428 wrote to memory of 2884 2428 cmd.exe 39 PID 2428 wrote to memory of 2652 2428 cmd.exe 40 PID 2428 wrote to memory of 2652 2428 cmd.exe 40 PID 2428 wrote to memory of 2652 2428 cmd.exe 40 PID 2428 wrote to memory of 2364 2428 cmd.exe 41 PID 2428 wrote to memory of 2364 2428 cmd.exe 41 PID 2428 wrote to memory of 2364 2428 cmd.exe 41 PID 2428 wrote to memory of 2732 2428 cmd.exe 42 PID 2428 wrote to memory of 2732 2428 cmd.exe 42 PID 2428 wrote to memory of 2732 2428 cmd.exe 42 PID 2428 wrote to memory of 2628 2428 cmd.exe 43 PID 2428 wrote to memory of 2628 2428 cmd.exe 43 PID 2428 wrote to memory of 2628 2428 cmd.exe 43
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Cleaners\clean4.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\taskkill.exetaskkill /f /im epicgameslauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_EAC.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_BE.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteLauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im UnrealCEFSubProcess.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im CEFProcess.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EasyAntiCheat.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEService.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEServices.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BattleEye.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628
-