Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
launcher.bat
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
launcher.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
witwin_st_x64.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
witwin_st_x64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
General
-
Target
launcher.bat
-
Size
75B
-
MD5
eb55186a25a8401bce6951cce620f9ef
-
SHA1
de8527377c8dab90ca8d20e74e210b86d0609295
-
SHA256
34ee234989a8d61ef10b8dc249335b82660d014f7ed4bd199110e1bb57b9ec57
-
SHA512
83d56e9c99fe10e0c58b51b236c39b71d52cc1c959efd1ef096b066bdd56fbf01b91f3a0c6732e76ee09295f922e33c4b53a56d07f6583f2c23333f357772490
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 19 IoCs
flow pid Process 15 3408 rundll32.exe 17 3408 rundll32.exe 19 3408 rundll32.exe 24 3408 rundll32.exe 41 3408 rundll32.exe 45 3408 rundll32.exe 48 3408 rundll32.exe 50 3408 rundll32.exe 52 3408 rundll32.exe 56 3408 rundll32.exe 57 3408 rundll32.exe 58 3408 rundll32.exe 59 3408 rundll32.exe 60 3408 rundll32.exe 61 3408 rundll32.exe 62 3408 rundll32.exe 63 3408 rundll32.exe 64 3408 rundll32.exe 65 3408 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe 3408 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4848 wrote to memory of 3408 4848 cmd.exe 83 PID 4848 wrote to memory of 3408 4848 cmd.exe 83
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\system32\rundll32.exerundll32.exe witwin_st_x64.dll,NxReleasePMap2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3408
-