Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20240704-de -
resource tags
arch:x64arch:x86image:win7-20240704-delocale:de-deos:windows7-x64systemwindows -
submitted
10/08/2024, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
Fiveguard Unbann.bat
Resource
win7-20240704-de
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Fiveguard Unbann.bat
Resource
win10v2004-20240802-de
4 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
-
Target
Fiveguard Unbann.bat
-
Size
300B
-
MD5
c99aaf4692dc68596153459bb3b4d7ce
-
SHA1
e65fd8078e9fee850c687ae3a3a744a1c718577e
-
SHA256
2b5a678098388f333f5297af1dddf3dc8541b7f9f8244db63f654a04b3bcda09
-
SHA512
7ff36fdffe442646c9ed5675d54394e4473f6908a5315dd5ce5472bb74e5e89bf9c1d8521cecc46639e458d57a290f96c983cf6c91f992d6476c545c55ed1228
Score
1/10
Malware Config
Signatures
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\dbb43b7c_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\faabe70_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\faabe70_0 reg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2528 1824 cmd.exe 31 PID 1824 wrote to memory of 2528 1824 cmd.exe 31 PID 1824 wrote to memory of 2528 1824 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Fiveguard Unbann.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore" /f2⤵
- Modifies Internet Explorer settings
PID:2528
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2768
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:3048