Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 12:02

General

  • Target

    Files/Apps/ctt.bat

  • Size

    200B

  • MD5

    1fb0778bf377299cf424b77cca45371b

  • SHA1

    21685d0e425d04192f122c94ccd209bfeab45e43

  • SHA256

    2a50f18aaa195155987ef3eb808c9b70e88c515ac49314ac22eceecbb790d86f

  • SHA512

    bfb48f3502bf32f5c21c0830df7de33c2772618fd0953ecede9106c921ce8df0acb62182b4a64dc961f2e07e940e39e189180b3c979e9f818c7a8d3acd4a87bb

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\ctt.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Windows\system32\fltMC.exe
      fltmc
      2⤵
        PID:1260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "iwr -useb https://christitus.com/win | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2388-4-0x000007FEF6ACE000-0x000007FEF6ACF000-memory.dmp

      Filesize

      4KB

    • memory/2388-7-0x000007FEF6810000-0x000007FEF71AD000-memory.dmp

      Filesize

      9.6MB

    • memory/2388-6-0x0000000002730000-0x0000000002738000-memory.dmp

      Filesize

      32KB

    • memory/2388-8-0x000007FEF6810000-0x000007FEF71AD000-memory.dmp

      Filesize

      9.6MB

    • memory/2388-5-0x000000001B610000-0x000000001B8F2000-memory.dmp

      Filesize

      2.9MB

    • memory/2388-9-0x000007FEF6810000-0x000007FEF71AD000-memory.dmp

      Filesize

      9.6MB

    • memory/2388-10-0x000007FEF6810000-0x000007FEF71AD000-memory.dmp

      Filesize

      9.6MB

    • memory/2388-11-0x000007FEF6810000-0x000007FEF71AD000-memory.dmp

      Filesize

      9.6MB