Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
iio.bat
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
iio.bat
Resource
win10v2004-20240802-en
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
iio.bat
-
Size
529B
-
MD5
4408c717590290587839b37ad06e2843
-
SHA1
5071a515dc397e55fe907452d6218ca48c5bde4c
-
SHA256
b4386e9cb13bba8fddbf2913fae7cd0ef99ab340d4492489b2cd578ffc106b01
-
SHA512
e64cf2a9ffc376b8ab8d97466ca4a7e61180fea5187065371aab26c712d94d549a601aa543a731b9c42cbe88f1a8ab1799cf07e814222693cf0f40b10e21d1b3
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings calc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 1276 shutdown.exe Token: SeRemoteShutdownPrivilege 1276 shutdown.exe Token: SeSystemtimePrivilege 1320 cmd.exe Token: SeSystemtimePrivilege 1320 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 456 OpenWith.exe 2780 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1320 wrote to memory of 4728 1320 cmd.exe 83 PID 1320 wrote to memory of 4728 1320 cmd.exe 83 PID 1320 wrote to memory of 3908 1320 cmd.exe 84 PID 1320 wrote to memory of 3908 1320 cmd.exe 84 PID 1320 wrote to memory of 1504 1320 cmd.exe 85 PID 1320 wrote to memory of 1504 1320 cmd.exe 85 PID 1320 wrote to memory of 1276 1320 cmd.exe 86 PID 1320 wrote to memory of 1276 1320 cmd.exe 86 PID 1320 wrote to memory of 3352 1320 cmd.exe 88 PID 1320 wrote to memory of 3352 1320 cmd.exe 88 PID 3352 wrote to memory of 2912 3352 cmd.exe 90 PID 3352 wrote to memory of 2912 3352 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\iio.bat"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\calc.execalc2⤵
- Modifies registry class
PID:4728
-
-
C:\Windows\system32\msg.exemsg * R.I.P2⤵PID:3908
-
-
C:\Windows\system32\msg.exemsg * R.I.P2⤵PID:1504
-
-
C:\Windows\system32\shutdown.exeshutdown -r -t 10 -c "VIRUS DETECTED"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start2⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\system32\cmd.execmd.exe3⤵PID:2912
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:456
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a9055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2780