Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
Controller.bat
Resource
win7-20240704-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Controller.bat
Resource
win10v2004-20240709-en
1 signatures
150 seconds
General
-
Target
Controller.bat
-
Size
772B
-
MD5
30a5dda500ce3c599c32068661a88fed
-
SHA1
76bfb4a510c537d64f07cfb75842aeddfa32f05a
-
SHA256
b31e49a3a4f4d405774a36753be099503aec1ab14fbcba5bb885b5d31e9f8216
-
SHA512
87396fe08b20e4ef6eb2076c8c22584c7a5775a884ffe4d789dbb0264cc4a1806ae78216ebc1c825849c8248c6bad983db29b538575b536ccb9bb0dbdd8b3c12
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2500 1860 cmd.exe 85 PID 1860 wrote to memory of 2500 1860 cmd.exe 85 PID 1860 wrote to memory of 2800 1860 cmd.exe 86 PID 1860 wrote to memory of 2800 1860 cmd.exe 86 PID 1860 wrote to memory of 4392 1860 cmd.exe 87 PID 1860 wrote to memory of 4392 1860 cmd.exe 87 PID 1860 wrote to memory of 3044 1860 cmd.exe 88 PID 1860 wrote to memory of 3044 1860 cmd.exe 88 PID 1860 wrote to memory of 4812 1860 cmd.exe 89 PID 1860 wrote to memory of 4812 1860 cmd.exe 89 PID 1860 wrote to memory of 4328 1860 cmd.exe 90 PID 1860 wrote to memory of 4328 1860 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Controller.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /F /V "HwSchMode" /T REG_DWORD /d "2"2⤵PID:2500
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSMQ\Parameters" /F /V "TCPNoDelay" /T REG_DWORD /d "1"2⤵PID:2800
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\PriorityControl" /F /V "Win32PrioritySeparation" /T REG_DWORD /d "40"2⤵PID:4392
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MMCSS" /F /V "Start" /T REG_DWORD /d2⤵PID:3044
-
-
C:\Windows\system32\reg.exereg.exe add "HKLM\SYSTEM\CurrentControlSet\Enum\%a\Device Parameters" /v SelectiveSuspendOn /t REG_DWORD /d 00000000 /f2⤵PID:4812
-
-
C:\Windows\system32\reg.exereg.exe add "HKLM\SYSTEM\CurrentControlSet\Enum\%a\Device Parameters" /v SelectiveSuspendEnabled /t REG_BINARY /d 00 /f2⤵PID:4328
-