Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
31003gdDR3/EAC.exe
windows7-x64
71003gdDR3/EAC.exe
windows10-2004-x64
71003gdDR3/EBC.sys
windows7-x64
11003gdDR3/EBC.sys
windows10-2004-x64
11003gdDR3/...AC.bat
windows7-x64
81003gdDR3/...AC.bat
windows10-2004-x64
81003gdDR3/...in.bat
windows7-x64
81003gdDR3/...in.bat
windows10-2004-x64
81003gdDR3/execute.sys
windows10-2004-x64
11003imxyvi...AC.exe
windows7-x64
71003imxyvi...AC.exe
windows10-2004-x64
71003imxyvi...AC.bat
windows7-x64
81003imxyvi...AC.bat
windows10-2004-x64
81003imxyvi...in.bat
windows7-x64
81003imxyvi...in.bat
windows10-2004-x64
81003imxyvi...ac.sys
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
1003gdDR3/EAC.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1003gdDR3/EAC.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
1003gdDR3/EBC.sys
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
1003gdDR3/EBC.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
1003gdDR3/InstallEAC.bat
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
1003gdDR3/InstallEAC.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1003gdDR3/InstallEAC_Admin.bat
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
1003gdDR3/InstallEAC_Admin.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1003gdDR3/execute.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
1003imxyviMapper/EAC.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
1003imxyviMapper/EAC.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
1003imxyviMapper/InstallEAC.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
1003imxyviMapper/InstallEAC.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
1003imxyviMapper/InstallEAC_Admin.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
1003imxyviMapper/InstallEAC_Admin.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
1003imxyviMapper/drvrecode_eac.sys
Resource
win10v2004-20240802-en
General
-
Target
1003imxyviMapper/InstallEAC_Admin.bat
-
Size
1KB
-
MD5
3402a6b0869b882edca22f6b9a84fbce
-
SHA1
55b7cf1b978ca46f4c72771bd3dcbf01726b5097
-
SHA256
63373f2382be919df008344c5666602feb3d08aad0fdb7e35427abf797909737
-
SHA512
78553aee42d8c3da70f2cd19c1c4ef1972c71b6b6c6e9a0fa86100a9e4b4967c309d4da181e7cbbab451c072c4ba0dabaffef8078cc6ff388c51ede37531a898
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" EAC.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EAC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EAC.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2888 EAC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 2888 EAC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2892 2216 cmd.exe 32 PID 2216 wrote to memory of 2892 2216 cmd.exe 32 PID 2216 wrote to memory of 2892 2216 cmd.exe 32 PID 2892 wrote to memory of 2680 2892 net.exe 33 PID 2892 wrote to memory of 2680 2892 net.exe 33 PID 2892 wrote to memory of 2680 2892 net.exe 33 PID 2216 wrote to memory of 2888 2216 cmd.exe 34 PID 2216 wrote to memory of 2888 2216 cmd.exe 34 PID 2216 wrote to memory of 2888 2216 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\InstallEAC_Admin.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\net.exeNET FILE2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 FILE3⤵PID:2680
-
-
-
C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\EAC.exeEAC.exe drvrecode_eac.sys2⤵
- Sets service image path in registry
- Checks BIOS information in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2888
-