Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Files/Apps/7z.bat
windows7-x64
10Files/Apps...F4.bat
windows7-x64
8Files/Apps/bts.bat
windows7-x64
3Files/Apps/chrome.bat
windows7-x64
8Files/Apps/ctt.bat
windows7-x64
3Files/Apps...ch.bat
windows7-x64
6Files/Apps...ox.bat
windows7-x64
1Files/Apps/flux.bat
windows7-x64
3Files/Apps/geek.bat
windows7-x64
10Files/Apps/git.bat
windows7-x64
8Files/Apps/logo.bat
windows7-x64
3Files/Apps/pcm.bat
windows7-x64
8Files/Apps/ps7.bat
windows7-x64
10Files/Apps/pswin7.bat
windows7-x64
10Files/Apps/winget.bat
windows7-x64
3Files/Apps...ys.bat
windows7-x64
3Files/Back...ry.bat
windows7-x64
1Files/Comm...me.bat
windows7-x64
1Files/Comp...ps.bat
windows7-x64
1Files/Comp...up.bat
windows7-x64
1Files/GPEE.bat
windows7-x64
1Files/IPGe...or.exe
windows7-x64
3Files/IPStealer.bat
windows7-x64
1Files/Impo...ps.bat
windows7-x64
1Files/InfoFinder.bat
windows7-x64
1Files/Malw...et.bat
windows7-x64
1Files/Newt...on.dll
windows7-x64
1Files/Pass...or.bat
windows7-x64
1Files/RAUP.bat
windows7-x64
1Files/SMBB...er.bat
windows7-x64
1Files/SSAMBYO.bat
windows7-x64
8Files/Schn...s).bat
windows7-x64
1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
Files/Apps/7z.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Files/Apps/SuperF4.bat
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Files/Apps/bts.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Files/Apps/chrome.bat
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
Files/Apps/ctt.bat
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Files/Apps/fastfetch.bat
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
Files/Apps/firefox.bat
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Files/Apps/flux.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
Files/Apps/geek.bat
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Files/Apps/git.bat
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
Files/Apps/logo.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Files/Apps/pcm.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
Files/Apps/ps7.bat
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Files/Apps/pswin7.bat
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
Files/Apps/winget.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Files/Apps/wintoys.bat
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
Files/BackupRegistry.bat
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Files/CommandLineGame.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
Files/Components/Import Backups.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Files/Components/Registry Backup.bat
Resource
win7-20240729-en
Behavioral task
behavioral21
Sample
Files/GPEE.bat
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Files/IPGeolocator.exe
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
Files/IPStealer.bat
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Files/ImportBackups.bat
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
Files/InfoFinder.bat
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Files/Malwarebytes-Premium-Reset.bat
Resource
win7-20240708-en
Behavioral task
behavioral27
Sample
Files/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Files/PasswordGenerator.bat
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
Files/RAUP.bat
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Files/SMBBruteforcer.bat
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
Files/SSAMBYO.bat
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Files/Schnuker/Files/Run Me (Instructions).bat
Resource
win7-20240903-en
General
-
Target
Files/Apps/ctt.bat
-
Size
200B
-
MD5
1fb0778bf377299cf424b77cca45371b
-
SHA1
21685d0e425d04192f122c94ccd209bfeab45e43
-
SHA256
2a50f18aaa195155987ef3eb808c9b70e88c515ac49314ac22eceecbb790d86f
-
SHA512
bfb48f3502bf32f5c21c0830df7de33c2772618fd0953ecede9106c921ce8df0acb62182b4a64dc961f2e07e940e39e189180b3c979e9f818c7a8d3acd4a87bb
Malware Config
Signatures
-
pid Process 2388 powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2388 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2388 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2892 wrote to memory of 1260 2892 cmd.exe 31 PID 2892 wrote to memory of 1260 2892 cmd.exe 31 PID 2892 wrote to memory of 1260 2892 cmd.exe 31 PID 2892 wrote to memory of 2388 2892 cmd.exe 32 PID 2892 wrote to memory of 2388 2892 cmd.exe 32 PID 2892 wrote to memory of 2388 2892 cmd.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\ctt.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\fltMC.exefltmc2⤵PID:1260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "iwr -useb https://christitus.com/win | iex"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
-