Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    10s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/09/2024, 16:23

Errors

Reason
Machine shutdown

General

  • Target

    nn.bat

  • Size

    7KB

  • MD5

    a698281208df9c1bf652160db544df96

  • SHA1

    95be6b96de22848da36e2031662ba66b3ac8bb5c

  • SHA256

    ab2d272037105f2f34b7b1572adbe05069cbcc0625115a2160df73118c25700f

  • SHA512

    875c67215b1f628d331df4792a0753ef3887de16505d62266ae514114f498fce3aa67abef521bce819a77146311995e686affeabc0cd251d076924e402262d0e

  • SSDEEP

    96:g/WJ/2OwYDFOleGU8xCowaLpRgpeTfhyXz8aOO46bKJUHGYd1GYWRUvg16IGo6jb:JV2O9QCSQUzVRJUH1n1WRsg15u/co4i

Score
1/10

Malware Config

Signatures

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nn.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      2⤵
      • Delays execution with timeout.exe
      PID:780
    • C:\Windows\system32\taskkill.exe
      taskkill /f /im svchost.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads