Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Files/Apps/7z.bat
windows7-x64
10Files/Apps...F4.bat
windows7-x64
8Files/Apps/bts.bat
windows7-x64
3Files/Apps/chrome.bat
windows7-x64
8Files/Apps/ctt.bat
windows7-x64
3Files/Apps...ch.bat
windows7-x64
6Files/Apps...ox.bat
windows7-x64
1Files/Apps/flux.bat
windows7-x64
3Files/Apps/geek.bat
windows7-x64
10Files/Apps/git.bat
windows7-x64
8Files/Apps/logo.bat
windows7-x64
3Files/Apps/pcm.bat
windows7-x64
8Files/Apps/ps7.bat
windows7-x64
10Files/Apps/pswin7.bat
windows7-x64
10Files/Apps/winget.bat
windows7-x64
3Files/Apps...ys.bat
windows7-x64
3Files/Back...ry.bat
windows7-x64
1Files/Comm...me.bat
windows7-x64
1Files/Comp...ps.bat
windows7-x64
1Files/Comp...up.bat
windows7-x64
1Files/GPEE.bat
windows7-x64
1Files/IPGe...or.exe
windows7-x64
3Files/IPStealer.bat
windows7-x64
1Files/Impo...ps.bat
windows7-x64
1Files/InfoFinder.bat
windows7-x64
1Files/Malw...et.bat
windows7-x64
1Files/Newt...on.dll
windows7-x64
1Files/Pass...or.bat
windows7-x64
1Files/RAUP.bat
windows7-x64
1Files/SMBB...er.bat
windows7-x64
1Files/SSAMBYO.bat
windows7-x64
8Files/Schn...s).bat
windows7-x64
1Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
Files/Apps/7z.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Files/Apps/SuperF4.bat
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Files/Apps/bts.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Files/Apps/chrome.bat
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
Files/Apps/ctt.bat
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Files/Apps/fastfetch.bat
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
Files/Apps/firefox.bat
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Files/Apps/flux.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
Files/Apps/geek.bat
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Files/Apps/git.bat
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
Files/Apps/logo.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Files/Apps/pcm.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
Files/Apps/ps7.bat
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Files/Apps/pswin7.bat
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
Files/Apps/winget.bat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Files/Apps/wintoys.bat
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
Files/BackupRegistry.bat
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Files/CommandLineGame.bat
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
Files/Components/Import Backups.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Files/Components/Registry Backup.bat
Resource
win7-20240729-en
Behavioral task
behavioral21
Sample
Files/GPEE.bat
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Files/IPGeolocator.exe
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
Files/IPStealer.bat
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Files/ImportBackups.bat
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
Files/InfoFinder.bat
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Files/Malwarebytes-Premium-Reset.bat
Resource
win7-20240708-en
Behavioral task
behavioral27
Sample
Files/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Files/PasswordGenerator.bat
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
Files/RAUP.bat
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Files/SMBBruteforcer.bat
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
Files/SSAMBYO.bat
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Files/Schnuker/Files/Run Me (Instructions).bat
Resource
win7-20240903-en
General
-
Target
Files/Apps/fastfetch.bat
-
Size
300B
-
MD5
c6217cbda600f1e677678d6aa64d30d4
-
SHA1
dda86d62ec1c6dea38d967d72e2cf2557d8707f5
-
SHA256
c0fdcdf351b3e1660254b073f448c21c9ab9b36da4d480cfef7e05c4ed589619
-
SHA512
470b2322425caeb48de5066c51221f3ec87c6b6e84dcfc3de705496d9e426c37add0cd2d54ba02006259035b37273f518d9cd512c14e875eee8a2627d4c346f8
Malware Config
Signatures
-
pid Process 2732 powershell.exe 2240 powershell.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2840 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2732 powershell.exe 2240 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 2240 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2732 2468 cmd.exe 31 PID 2468 wrote to memory of 2732 2468 cmd.exe 31 PID 2468 wrote to memory of 2732 2468 cmd.exe 31 PID 2468 wrote to memory of 2240 2468 cmd.exe 32 PID 2468 wrote to memory of 2240 2468 cmd.exe 32 PID 2468 wrote to memory of 2240 2468 cmd.exe 32 PID 2468 wrote to memory of 2840 2468 cmd.exe 33 PID 2468 wrote to memory of 2840 2468 cmd.exe 33 PID 2468 wrote to memory of 2840 2468 cmd.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\fastfetch.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "iwr -useb get.scoop.sh | iex"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\system32\timeout.exetimeout /t 52⤵
- Delays execution with timeout.exe
PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6BRUQC9CLI5651G0BBR3.temp
Filesize7KB
MD587eaccda3a6f6ac06656bed32517a4b4
SHA175e14a777b03d80c42ca6f287f841e88cdbbd977
SHA2566fb3830c5ae460f43a097dcf7ae256fa6ec1312c7a9ca15403a111b8edd780ef
SHA5122182307535e23e66be161b1b9d7e6d12df32e2d3792b7870eefcb71ca0b5c258a651a4b05b84c6f0f402a06d57be56c1a946f9c3c4422327d318097ee55dd0a2