Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 20:10

General

  • Target

    1003imxyviMapper/InstallEAC_Admin.bat

  • Size

    1KB

  • MD5

    3402a6b0869b882edca22f6b9a84fbce

  • SHA1

    55b7cf1b978ca46f4c72771bd3dcbf01726b5097

  • SHA256

    63373f2382be919df008344c5666602feb3d08aad0fdb7e35427abf797909737

  • SHA512

    78553aee42d8c3da70f2cd19c1c4ef1972c71b6b6c6e9a0fa86100a9e4b4967c309d4da181e7cbbab451c072c4ba0dabaffef8078cc6ff388c51ede37531a898

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\InstallEAC_Admin.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Windows\system32\net.exe
      NET FILE
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 FILE
        3⤵
          PID:3204
      • C:\Users\Admin\AppData\Local\Temp\1003imxyviMapper\EAC.exe
        EAC.exe drvrecode_eac.sys
        2⤵
        • Sets service image path in registry
        • Checks BIOS information in registry
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/212-0-0x00007FF75C8E0000-0x00007FF75CEF2000-memory.dmp

      Filesize

      6.1MB

    • memory/212-1-0x00007FFF862F0000-0x00007FFF862F2000-memory.dmp

      Filesize

      8KB

    • memory/212-3-0x00007FF75C8E0000-0x00007FF75CEF2000-memory.dmp

      Filesize

      6.1MB