Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    24s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 14:05

Errors

Reason
Machine shutdown

General

  • Target

    counter.bat

  • Size

    922B

  • MD5

    3c0dcc7c834043a507aec027e0c7a08d

  • SHA1

    c59c4912ea297bae786e6150022ee776db917b30

  • SHA256

    4274267b6e4f82153a75189c431b79cb19464758e0dc89a8ebd3c2c2a0d0570d

  • SHA512

    c3bcffb692562d3d715992b96d5cce80447e6c67e0c2d4caca159c07d5855370e10ff4f3769547483783d0bab18adde1410c752f53db83331edc208d9f87abc0

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\counter.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Windows\system32\taskkill.exe
      taskkill /IM explorer.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Are you stupid?', 'Counter', 'YesNo', [System.Windows.Forms.MessageBoxIcon]::Warning);}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2892
    • C:\Windows\system32\shutdown.exe
      shutdown /s /f /t 6 /c "System where not found. Performing emergency shutdown."
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2584
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2612

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2892-4-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmp

        Filesize

        4KB

      • memory/2892-5-0x000000001B770000-0x000000001BA52000-memory.dmp

        Filesize

        2.9MB

      • memory/2892-7-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

        Filesize

        9.6MB

      • memory/2892-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

        Filesize

        32KB

      • memory/2892-8-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

        Filesize

        9.6MB

      • memory/2892-9-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

        Filesize

        9.6MB

      • memory/2892-10-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

        Filesize

        9.6MB

      • memory/2892-11-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmp

        Filesize

        4KB

      • memory/2892-12-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

        Filesize

        9.6MB

      • memory/2892-13-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

        Filesize

        9.6MB