Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3AMI/AMIDEWINx64.exe
windows7-x64
1AMI/AMIDEWINx64.exe
windows10-2004-x64
1AMI/amigendrv64.sys
windows10-2004-x64
1AMI/spoof.bat
windows7-x64
1AMI/spoof.bat
windows10-2004-x64
1Insyde/H2O...64.exe
windows7-x64
5Insyde/H2O...64.exe
windows10-2004-x64
Insyde/seg...64.sys
windows7-x64
1Insyde/seg...64.sys
windows10-2004-x64
1Insyde/spoof.bat
windows7-x64
5Insyde/spoof.bat
windows10-2004-x64
VHD/0.25000001.bat
windows7-x64
3VHD/0.25000001.bat
windows10-2004-x64
3check.bat
windows7-x64
1check.bat
windows10-2004-x64
5tweaks/1.bat
windows7-x64
10tweaks/1.bat
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
AMI/AMIDEWINx64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
AMI/AMIDEWINx64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
AMI/amigendrv64.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
AMI/spoof.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
AMI/spoof.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Insyde/H2OSDE-Wx64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
Insyde/H2OSDE-Wx64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Insyde/segwindrvx64.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
Insyde/segwindrvx64.sys
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Insyde/spoof.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
Insyde/spoof.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
VHD/0.25000001.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
VHD/0.25000001.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
check.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
check.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
tweaks/1.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
tweaks/1.bat
Resource
win10v2004-20240910-en
windows10-2004-x64
General
-
Target
check.bat
-
Size
274B
-
MD5
e8db7ba2184c7b20e20182d01522e6c6
-
SHA1
877be10ebd8d6281da715d96b4741dddbbd258c3
-
SHA256
3c36f73644642fa71c86fe48d24cc47f5293cedcec8bd0981d111e5823bda3ea
-
SHA512
1024d79d1b3f6208c577b7c45ac8e3a985887736af0712fbec2e54c837c4d6de14afa7dfbe58266d157490952c9a857a402ec3ec393d560d6611273aac55d529
Malware Config
Signatures
-
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2784 WMIC.exe Token: SeSecurityPrivilege 2784 WMIC.exe Token: SeTakeOwnershipPrivilege 2784 WMIC.exe Token: SeLoadDriverPrivilege 2784 WMIC.exe Token: SeSystemProfilePrivilege 2784 WMIC.exe Token: SeSystemtimePrivilege 2784 WMIC.exe Token: SeProfSingleProcessPrivilege 2784 WMIC.exe Token: SeIncBasePriorityPrivilege 2784 WMIC.exe Token: SeCreatePagefilePrivilege 2784 WMIC.exe Token: SeBackupPrivilege 2784 WMIC.exe Token: SeRestorePrivilege 2784 WMIC.exe Token: SeShutdownPrivilege 2784 WMIC.exe Token: SeDebugPrivilege 2784 WMIC.exe Token: SeSystemEnvironmentPrivilege 2784 WMIC.exe Token: SeRemoteShutdownPrivilege 2784 WMIC.exe Token: SeUndockPrivilege 2784 WMIC.exe Token: SeManageVolumePrivilege 2784 WMIC.exe Token: 33 2784 WMIC.exe Token: 34 2784 WMIC.exe Token: 35 2784 WMIC.exe Token: SeIncreaseQuotaPrivilege 2784 WMIC.exe Token: SeSecurityPrivilege 2784 WMIC.exe Token: SeTakeOwnershipPrivilege 2784 WMIC.exe Token: SeLoadDriverPrivilege 2784 WMIC.exe Token: SeSystemProfilePrivilege 2784 WMIC.exe Token: SeSystemtimePrivilege 2784 WMIC.exe Token: SeProfSingleProcessPrivilege 2784 WMIC.exe Token: SeIncBasePriorityPrivilege 2784 WMIC.exe Token: SeCreatePagefilePrivilege 2784 WMIC.exe Token: SeBackupPrivilege 2784 WMIC.exe Token: SeRestorePrivilege 2784 WMIC.exe Token: SeShutdownPrivilege 2784 WMIC.exe Token: SeDebugPrivilege 2784 WMIC.exe Token: SeSystemEnvironmentPrivilege 2784 WMIC.exe Token: SeRemoteShutdownPrivilege 2784 WMIC.exe Token: SeUndockPrivilege 2784 WMIC.exe Token: SeManageVolumePrivilege 2784 WMIC.exe Token: 33 2784 WMIC.exe Token: 34 2784 WMIC.exe Token: 35 2784 WMIC.exe Token: SeIncreaseQuotaPrivilege 2520 WMIC.exe Token: SeSecurityPrivilege 2520 WMIC.exe Token: SeTakeOwnershipPrivilege 2520 WMIC.exe Token: SeLoadDriverPrivilege 2520 WMIC.exe Token: SeSystemProfilePrivilege 2520 WMIC.exe Token: SeSystemtimePrivilege 2520 WMIC.exe Token: SeProfSingleProcessPrivilege 2520 WMIC.exe Token: SeIncBasePriorityPrivilege 2520 WMIC.exe Token: SeCreatePagefilePrivilege 2520 WMIC.exe Token: SeBackupPrivilege 2520 WMIC.exe Token: SeRestorePrivilege 2520 WMIC.exe Token: SeShutdownPrivilege 2520 WMIC.exe Token: SeDebugPrivilege 2520 WMIC.exe Token: SeSystemEnvironmentPrivilege 2520 WMIC.exe Token: SeRemoteShutdownPrivilege 2520 WMIC.exe Token: SeUndockPrivilege 2520 WMIC.exe Token: SeManageVolumePrivilege 2520 WMIC.exe Token: 33 2520 WMIC.exe Token: 34 2520 WMIC.exe Token: 35 2520 WMIC.exe Token: SeIncreaseQuotaPrivilege 2520 WMIC.exe Token: SeSecurityPrivilege 2520 WMIC.exe Token: SeTakeOwnershipPrivilege 2520 WMIC.exe Token: SeLoadDriverPrivilege 2520 WMIC.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 800 wrote to memory of 3044 800 cmd.exe 29 PID 800 wrote to memory of 3044 800 cmd.exe 29 PID 800 wrote to memory of 3044 800 cmd.exe 29 PID 3044 wrote to memory of 2068 3044 net.exe 30 PID 3044 wrote to memory of 2068 3044 net.exe 30 PID 3044 wrote to memory of 2068 3044 net.exe 30 PID 800 wrote to memory of 2784 800 cmd.exe 31 PID 800 wrote to memory of 2784 800 cmd.exe 31 PID 800 wrote to memory of 2784 800 cmd.exe 31 PID 800 wrote to memory of 2520 800 cmd.exe 33 PID 800 wrote to memory of 2520 800 cmd.exe 33 PID 800 wrote to memory of 2520 800 cmd.exe 33 PID 800 wrote to memory of 2540 800 cmd.exe 34 PID 800 wrote to memory of 2540 800 cmd.exe 34 PID 800 wrote to memory of 2540 800 cmd.exe 34 PID 800 wrote to memory of 2508 800 cmd.exe 35 PID 800 wrote to memory of 2508 800 cmd.exe 35 PID 800 wrote to memory of 2508 800 cmd.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\check.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:2068
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer, product, serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get manufacturer, releasedate, serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get name, uuid2⤵PID:2540
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber2⤵PID:2508
-