Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Cleaners/a...er.exe
windows7-x64
9Cleaners/a...er.exe
windows10-2004-x64
9Cleaners/a...rm.exe
windows7-x64
7Cleaners/a...rm.exe
windows10-2004-x64
7Cleaners/clean1.bat
windows7-x64
7Cleaners/clean1.bat
windows10-2004-x64
5Cleaners/clean2.bat
windows7-x64
7Cleaners/clean2.bat
windows10-2004-x64
4Cleaners/clean3.bat
windows7-x64
1Cleaners/clean3.bat
windows10-2004-x64
1Cleaners/clean4.bat
windows7-x64
1Cleaners/clean4.bat
windows10-2004-x64
1Cleaners/clean5.bat
windows7-x64
7Cleaners/clean5.bat
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 07:24
Behavioral task
behavioral1
Sample
Cleaners/applecleaner.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cleaners/applecleaner.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Cleaners/applecperm.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Cleaners/applecperm.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Cleaners/clean1.bat
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Cleaners/clean1.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Cleaners/clean2.bat
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Cleaners/clean2.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Cleaners/clean3.bat
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Cleaners/clean3.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Cleaners/clean4.bat
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Cleaners/clean4.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Cleaners/clean5.bat
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Cleaners/clean5.bat
Resource
win10v2004-20240709-en
General
-
Target
Cleaners/clean4.bat
-
Size
853KB
-
MD5
d4c34b33b42ce1a0aa1227fa3a768124
-
SHA1
796606e45d27fd332c6143f6f09cef3c8a522493
-
SHA256
d2f5b505cd5a6baaabb9d1f51f6b5800139034db44e220f83b44cd66b3197b38
-
SHA512
33ffd3944bfe182cfcd9f40bb73af997db37692f6a769953e931af24acbebaa2a698254860fc2095cd507d84a2437907016cc8d1bd3614cf6899f6428ef86ff1
-
SSDEEP
6144:5tJVSIIgunYMX7GmOgDsMrODuUpW/kBkOR1:X6IIgunYMKmOgDsMrODuUpW/kBkOR1
Malware Config
Signatures
-
Kills process with taskkill 11 IoCs
pid Process 1008 taskkill.exe 3168 taskkill.exe 1608 taskkill.exe 408 taskkill.exe 3980 taskkill.exe 2940 taskkill.exe 2780 taskkill.exe 2408 taskkill.exe 1180 taskkill.exe 4260 taskkill.exe 4400 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1008 taskkill.exe Token: SeDebugPrivilege 3168 taskkill.exe Token: SeDebugPrivilege 1180 taskkill.exe Token: SeDebugPrivilege 4260 taskkill.exe Token: SeDebugPrivilege 4400 taskkill.exe Token: SeDebugPrivilege 408 taskkill.exe Token: SeDebugPrivilege 3980 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 2940 taskkill.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 2408 taskkill.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3256 wrote to memory of 1008 3256 cmd.exe 86 PID 3256 wrote to memory of 1008 3256 cmd.exe 86 PID 3256 wrote to memory of 3168 3256 cmd.exe 88 PID 3256 wrote to memory of 3168 3256 cmd.exe 88 PID 3256 wrote to memory of 1180 3256 cmd.exe 90 PID 3256 wrote to memory of 1180 3256 cmd.exe 90 PID 3256 wrote to memory of 4260 3256 cmd.exe 91 PID 3256 wrote to memory of 4260 3256 cmd.exe 91 PID 3256 wrote to memory of 4400 3256 cmd.exe 92 PID 3256 wrote to memory of 4400 3256 cmd.exe 92 PID 3256 wrote to memory of 408 3256 cmd.exe 93 PID 3256 wrote to memory of 408 3256 cmd.exe 93 PID 3256 wrote to memory of 3980 3256 cmd.exe 94 PID 3256 wrote to memory of 3980 3256 cmd.exe 94 PID 3256 wrote to memory of 1608 3256 cmd.exe 95 PID 3256 wrote to memory of 1608 3256 cmd.exe 95 PID 3256 wrote to memory of 2940 3256 cmd.exe 96 PID 3256 wrote to memory of 2940 3256 cmd.exe 96 PID 3256 wrote to memory of 2780 3256 cmd.exe 97 PID 3256 wrote to memory of 2780 3256 cmd.exe 97 PID 3256 wrote to memory of 2408 3256 cmd.exe 98 PID 3256 wrote to memory of 2408 3256 cmd.exe 98
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cleaners\clean4.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\taskkill.exetaskkill /f /im epicgameslauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_EAC.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping_BE.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteLauncher.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im UnrealCEFSubProcess.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im CEFProcess.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EasyAntiCheat.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEService.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BEServices.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BattleEye.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2408
-