Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 20:10

General

  • Target

    1003imxyviMapper/InstallEAC_Admin.bat

  • Size

    1KB

  • MD5

    3402a6b0869b882edca22f6b9a84fbce

  • SHA1

    55b7cf1b978ca46f4c72771bd3dcbf01726b5097

  • SHA256

    63373f2382be919df008344c5666602feb3d08aad0fdb7e35427abf797909737

  • SHA512

    78553aee42d8c3da70f2cd19c1c4ef1972c71b6b6c6e9a0fa86100a9e4b4967c309d4da181e7cbbab451c072c4ba0dabaffef8078cc6ff388c51ede37531a898

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\InstallEAC_Admin.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\system32\net.exe
      NET FILE
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 FILE
        3⤵
          PID:2680
      • C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\EAC.exe
        EAC.exe drvrecode_eac.sys
        2⤵
        • Sets service image path in registry
        • Checks BIOS information in registry
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:2888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2216-0-0x000000013FAE0000-0x00000001400F2000-memory.dmp

      Filesize

      6.1MB

    • memory/2216-7-0x000000013FAE0000-0x00000001400F2000-memory.dmp

      Filesize

      6.1MB

    • memory/2888-1-0x000000013FAE0000-0x00000001400F2000-memory.dmp

      Filesize

      6.1MB

    • memory/2888-2-0x0000000077A40000-0x0000000077A42000-memory.dmp

      Filesize

      8KB

    • memory/2888-5-0x00000000041A0000-0x0000000004788000-memory.dmp

      Filesize

      5.9MB

    • memory/2888-6-0x000000013FAE0000-0x00000001400F2000-memory.dmp

      Filesize

      6.1MB