Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
counter.bat
Resource
win7-20240903-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
counter.bat
Resource
win10v2004-20240802-en
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
counter.bat
-
Size
922B
-
MD5
3c0dcc7c834043a507aec027e0c7a08d
-
SHA1
c59c4912ea297bae786e6150022ee776db917b30
-
SHA256
4274267b6e4f82153a75189c431b79cb19464758e0dc89a8ebd3c2c2a0d0570d
-
SHA512
c3bcffb692562d3d715992b96d5cce80447e6c67e0c2d4caca159c07d5855370e10ff4f3769547483783d0bab18adde1410c752f53db83331edc208d9f87abc0
Score
3/10
Malware Config
Signatures
-
pid Process 2892 powershell.exe -
Kills process with taskkill 1 IoCs
pid Process 1988 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1988 taskkill.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeShutdownPrivilege 2684 shutdown.exe Token: SeRemoteShutdownPrivilege 2684 shutdown.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1988 1484 cmd.exe 32 PID 1484 wrote to memory of 1988 1484 cmd.exe 32 PID 1484 wrote to memory of 1988 1484 cmd.exe 32 PID 1484 wrote to memory of 2892 1484 cmd.exe 34 PID 1484 wrote to memory of 2892 1484 cmd.exe 34 PID 1484 wrote to memory of 2892 1484 cmd.exe 34 PID 1484 wrote to memory of 2684 1484 cmd.exe 35 PID 1484 wrote to memory of 2684 1484 cmd.exe 35 PID 1484 wrote to memory of 2684 1484 cmd.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\counter.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\taskkill.exetaskkill /IM explorer.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Are you stupid?', 'Counter', 'YesNo', [System.Windows.Forms.MessageBoxIcon]::Warning);}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\system32\shutdown.exeshutdown /s /f /t 6 /c "System where not found. Performing emergency shutdown."2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2584
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2612