Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    13s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 20:10

General

  • Target

    1003imxyviMapper/InstallEAC.bat

  • Size

    43B

  • MD5

    35ddf9efd9112d982292c7d622f60c68

  • SHA1

    c6c7a96f136894131c9c6a3190eb835faf55418e

  • SHA256

    42a0560ea661a122ec99eb7ec201f9f47e679c24b1afa54a7dac4b0be95105ff

  • SHA512

    cae665bfd3bd698d03f32d24e8a44c49292ef3dc92c00dd6f4a30d47f63521675b68c96facab797c890246388987dd66ae52c0d394458bb89c41990d7c0e240d

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\InstallEAC.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:792
    • C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\EAC.exe
      EAC.exe drvrecode_eac.sys
      2⤵
      • Sets service image path in registry
      • Checks BIOS information in registry
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/792-0-0x000000013F580000-0x000000013FB92000-memory.dmp

    Filesize

    6.1MB

  • memory/792-7-0x000000013F580000-0x000000013FB92000-memory.dmp

    Filesize

    6.1MB

  • memory/2204-6-0x000000013F580000-0x000000013FB92000-memory.dmp

    Filesize

    6.1MB

  • memory/2204-5-0x0000000140000000-0x00000001405E8000-memory.dmp

    Filesize

    5.9MB

  • memory/2204-2-0x0000000076D80000-0x0000000076D82000-memory.dmp

    Filesize

    8KB

  • memory/2204-1-0x000000013F580000-0x000000013FB92000-memory.dmp

    Filesize

    6.1MB