Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
ScaryLarry.bat
Resource
win7-20240705-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScaryLarry.bat
Resource
win10v2004-20240802-en
7 signatures
150 seconds
General
-
Target
ScaryLarry.bat
-
Size
1KB
-
MD5
04e38f8edf7a73a04c94407ffb02e335
-
SHA1
6a7e89633a43b1323af89e79f5163a23d9382c94
-
SHA256
0bbb936eebd11c7bd9709a9570db61afd101bbc27d376d52d8ee2688895bc148
-
SHA512
14d13c90d93edbdbbc0b1061d9d1653a6f8cdc2aad43fee848d3c689f8b820ecb4e41be2ebcadc0b951b677ded3e1228ef7fb71bfbcf2cad43d3c3ecae801fe2
Score
3/10
Malware Config
Signatures
-
pid Process 2196 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2196 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2196 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2196 2852 cmd.exe 31 PID 2852 wrote to memory of 2196 2852 cmd.exe 31 PID 2852 wrote to memory of 2196 2852 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ScaryLarry.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('If you dont dont know what you had executed then press No but if you know what you are doing and you are an malware ethusiat and using proper equipment press Yes ', 'THIS IS A MALWARE', 'YesNo', [System.Windows.Forms.MessageBoxIcon]::Error);}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196
-