Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
31003gdDR3/EAC.exe
windows7-x64
71003gdDR3/EAC.exe
windows10-2004-x64
71003gdDR3/EBC.sys
windows7-x64
11003gdDR3/EBC.sys
windows10-2004-x64
11003gdDR3/...AC.bat
windows7-x64
81003gdDR3/...AC.bat
windows10-2004-x64
81003gdDR3/...in.bat
windows7-x64
81003gdDR3/...in.bat
windows10-2004-x64
81003gdDR3/execute.sys
windows10-2004-x64
11003imxyvi...AC.exe
windows7-x64
71003imxyvi...AC.exe
windows10-2004-x64
71003imxyvi...AC.bat
windows7-x64
81003imxyvi...AC.bat
windows10-2004-x64
81003imxyvi...in.bat
windows7-x64
81003imxyvi...in.bat
windows10-2004-x64
81003imxyvi...ac.sys
windows10-2004-x64
1Analysis
-
max time kernel
95s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
1003gdDR3/EAC.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1003gdDR3/EAC.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
1003gdDR3/EBC.sys
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
1003gdDR3/EBC.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
1003gdDR3/InstallEAC.bat
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
1003gdDR3/InstallEAC.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1003gdDR3/InstallEAC_Admin.bat
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
1003gdDR3/InstallEAC_Admin.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1003gdDR3/execute.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
1003imxyviMapper/EAC.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
1003imxyviMapper/EAC.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
1003imxyviMapper/InstallEAC.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
1003imxyviMapper/InstallEAC.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
1003imxyviMapper/InstallEAC_Admin.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
1003imxyviMapper/InstallEAC_Admin.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
1003imxyviMapper/drvrecode_eac.sys
Resource
win10v2004-20240802-en
General
-
Target
1003gdDR3/InstallEAC_Admin.bat
-
Size
1KB
-
MD5
4201e0fffc468e12b613c17e36daed90
-
SHA1
a40edc8576987c26027fd2e3d5f0d5e873f2f0db
-
SHA256
4dad1df7f54f5b75bd4bf4ecec1cd8520a028c7b2e5254041cd487f3e7f1d164
-
SHA512
3733bcc1ebcd3feec3466485ed6cd2df376d3a8b9b4bbbd6c73209c8a901353c3153966bdfd2f71c36edef28842229154ce44d3fe060683aa076230bb9f1ce20
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\execute\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\1003gdDR3\\execute.sys" EAC.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EBC\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\1003gdDR3\\EBC.sys" EAC.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EAC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EAC.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4220 EAC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 4220 EAC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3420 wrote to memory of 4600 3420 cmd.exe 83 PID 3420 wrote to memory of 4600 3420 cmd.exe 83 PID 4600 wrote to memory of 4168 4600 net.exe 84 PID 4600 wrote to memory of 4168 4600 net.exe 84 PID 3420 wrote to memory of 4220 3420 cmd.exe 85 PID 3420 wrote to memory of 4220 3420 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1003gdDR3\InstallEAC_Admin.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\system32\net.exeNET FILE2⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 FILE3⤵PID:4168
-
-
-
C:\Users\Admin\AppData\Local\Temp\1003gdDR3\EAC.exeEAC.exe EBC.sys execute.sys2⤵
- Sets service image path in registry
- Checks BIOS information in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4220
-