Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
MomGrabber.bat
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MomGrabber.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
MomGrabber.bat
-
Size
727B
-
MD5
8691d8696a4b87bab23b707f6c9a9fa7
-
SHA1
fc34c04ffd8ba2d8e4b4240fb5125bfe9ec8f455
-
SHA256
c372a7a932e36fe62d705e40061a72c8f7420188707c9317c88d149181cd4b03
-
SHA512
716ea20bd8f8f32fea0356742ea277ede9136df27fb893bf11551db781d03aa3de2c900b437d50b1081f99592bfbecab4b2a5d849d0a6e1608c7e78a68f028a9
Score
1/10
Malware Config
Signatures
-
Delays execution with timeout.exe 1 IoCs
pid Process 2868 timeout.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2832 WMIC.exe Token: SeSecurityPrivilege 2832 WMIC.exe Token: SeTakeOwnershipPrivilege 2832 WMIC.exe Token: SeLoadDriverPrivilege 2832 WMIC.exe Token: SeSystemProfilePrivilege 2832 WMIC.exe Token: SeSystemtimePrivilege 2832 WMIC.exe Token: SeProfSingleProcessPrivilege 2832 WMIC.exe Token: SeIncBasePriorityPrivilege 2832 WMIC.exe Token: SeCreatePagefilePrivilege 2832 WMIC.exe Token: SeBackupPrivilege 2832 WMIC.exe Token: SeRestorePrivilege 2832 WMIC.exe Token: SeShutdownPrivilege 2832 WMIC.exe Token: SeDebugPrivilege 2832 WMIC.exe Token: SeSystemEnvironmentPrivilege 2832 WMIC.exe Token: SeRemoteShutdownPrivilege 2832 WMIC.exe Token: SeUndockPrivilege 2832 WMIC.exe Token: SeManageVolumePrivilege 2832 WMIC.exe Token: 33 2832 WMIC.exe Token: 34 2832 WMIC.exe Token: 35 2832 WMIC.exe Token: SeIncreaseQuotaPrivilege 2832 WMIC.exe Token: SeSecurityPrivilege 2832 WMIC.exe Token: SeTakeOwnershipPrivilege 2832 WMIC.exe Token: SeLoadDriverPrivilege 2832 WMIC.exe Token: SeSystemProfilePrivilege 2832 WMIC.exe Token: SeSystemtimePrivilege 2832 WMIC.exe Token: SeProfSingleProcessPrivilege 2832 WMIC.exe Token: SeIncBasePriorityPrivilege 2832 WMIC.exe Token: SeCreatePagefilePrivilege 2832 WMIC.exe Token: SeBackupPrivilege 2832 WMIC.exe Token: SeRestorePrivilege 2832 WMIC.exe Token: SeShutdownPrivilege 2832 WMIC.exe Token: SeDebugPrivilege 2832 WMIC.exe Token: SeSystemEnvironmentPrivilege 2832 WMIC.exe Token: SeRemoteShutdownPrivilege 2832 WMIC.exe Token: SeUndockPrivilege 2832 WMIC.exe Token: SeManageVolumePrivilege 2832 WMIC.exe Token: 33 2832 WMIC.exe Token: 34 2832 WMIC.exe Token: 35 2832 WMIC.exe Token: SeIncreaseQuotaPrivilege 2844 WMIC.exe Token: SeSecurityPrivilege 2844 WMIC.exe Token: SeTakeOwnershipPrivilege 2844 WMIC.exe Token: SeLoadDriverPrivilege 2844 WMIC.exe Token: SeSystemProfilePrivilege 2844 WMIC.exe Token: SeSystemtimePrivilege 2844 WMIC.exe Token: SeProfSingleProcessPrivilege 2844 WMIC.exe Token: SeIncBasePriorityPrivilege 2844 WMIC.exe Token: SeCreatePagefilePrivilege 2844 WMIC.exe Token: SeBackupPrivilege 2844 WMIC.exe Token: SeRestorePrivilege 2844 WMIC.exe Token: SeShutdownPrivilege 2844 WMIC.exe Token: SeDebugPrivilege 2844 WMIC.exe Token: SeSystemEnvironmentPrivilege 2844 WMIC.exe Token: SeRemoteShutdownPrivilege 2844 WMIC.exe Token: SeUndockPrivilege 2844 WMIC.exe Token: SeManageVolumePrivilege 2844 WMIC.exe Token: 33 2844 WMIC.exe Token: 34 2844 WMIC.exe Token: 35 2844 WMIC.exe Token: SeIncreaseQuotaPrivilege 2844 WMIC.exe Token: SeSecurityPrivilege 2844 WMIC.exe Token: SeTakeOwnershipPrivilege 2844 WMIC.exe Token: SeLoadDriverPrivilege 2844 WMIC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2832 2616 cmd.exe 30 PID 2616 wrote to memory of 2832 2616 cmd.exe 30 PID 2616 wrote to memory of 2832 2616 cmd.exe 30 PID 2616 wrote to memory of 2844 2616 cmd.exe 32 PID 2616 wrote to memory of 2844 2616 cmd.exe 32 PID 2616 wrote to memory of 2844 2616 cmd.exe 32 PID 2616 wrote to memory of 3048 2616 cmd.exe 33 PID 2616 wrote to memory of 3048 2616 cmd.exe 33 PID 2616 wrote to memory of 3048 2616 cmd.exe 33 PID 2616 wrote to memory of 2868 2616 cmd.exe 34 PID 2616 wrote to memory of 2868 2616 cmd.exe 34 PID 2616 wrote to memory of 2868 2616 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MomGrabber.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get /format:list2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get /format:list2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get /format:list2⤵PID:3048
-
-
C:\Windows\system32\timeout.exetimeout 1 /nobreak2⤵
- Delays execution with timeout.exe
PID:2868
-