Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    13s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 14:40

General

  • Target

    !inject.bat

  • Size

    96B

  • MD5

    90b6e06f279f201562460d3b38bd8b0a

  • SHA1

    9b2f3b4b7bf08a1a897b30ab787a9b1a7e9dfdf1

  • SHA256

    ea426d508f92d25c545dc3f5f03a80db60e88a4ba11ad40d93e6c43bb64dac1f

  • SHA512

    09a7ad9518e48117f542097697795d0d1c04c2a02efe28060b8beed49d2386325045c9d54137d823cd107a1101c33d8bd27e6a6f4e832ab27132038659d80cde

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\!inject.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Users\Admin\AppData\Local\Temp\smi.exe
      smi.exe inject -p "Lethal Company" -a ProjectApparatus.dll -n ProjectApparatus -c Loader -m Init
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2328 -s 652
        3⤵
          PID:2868

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2328-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

      Filesize

      4KB

    • memory/2328-1-0x0000000000080000-0x000000000008A000-memory.dmp

      Filesize

      40KB

    • memory/2328-2-0x0000000000170000-0x000000000017C000-memory.dmp

      Filesize

      48KB

    • memory/2328-4-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

      Filesize

      4KB