Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 11:57
Static task
static1
Behavioral task
behavioral1
Sample
bat[1].bat
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bat[1].bat
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bat[1].bat
-
Size
4.9MB
-
MD5
cbbb8311a661135f846908c85c3aa59f
-
SHA1
d1d00695d65c8be7328881a7e24a2d844f1e5428
-
SHA256
cc1edd890563ed822c714ec97f4d8431d679161b89ee035e907b1d6df09c03e5
-
SHA512
83bc82a91dae947a202dec6bdce3ffeafca4e111afbbdfe5fe8394ed2da6bc9d884f058b045381bb86a91a883aae89b0172839f9a2eb0a7dc5e8d5ca97a49beb
-
SSDEEP
49152:et6+yh48tXPwBb78W9yt3xBjtPm/pAEmbHqTN0Q1ScyHqAM/Lt2nTwKYR4tiZB:c
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2820 WMIC.exe Token: SeSecurityPrivilege 2820 WMIC.exe Token: SeTakeOwnershipPrivilege 2820 WMIC.exe Token: SeLoadDriverPrivilege 2820 WMIC.exe Token: SeSystemProfilePrivilege 2820 WMIC.exe Token: SeSystemtimePrivilege 2820 WMIC.exe Token: SeProfSingleProcessPrivilege 2820 WMIC.exe Token: SeIncBasePriorityPrivilege 2820 WMIC.exe Token: SeCreatePagefilePrivilege 2820 WMIC.exe Token: SeBackupPrivilege 2820 WMIC.exe Token: SeRestorePrivilege 2820 WMIC.exe Token: SeShutdownPrivilege 2820 WMIC.exe Token: SeDebugPrivilege 2820 WMIC.exe Token: SeSystemEnvironmentPrivilege 2820 WMIC.exe Token: SeRemoteShutdownPrivilege 2820 WMIC.exe Token: SeUndockPrivilege 2820 WMIC.exe Token: SeManageVolumePrivilege 2820 WMIC.exe Token: 33 2820 WMIC.exe Token: 34 2820 WMIC.exe Token: 35 2820 WMIC.exe Token: 36 2820 WMIC.exe Token: SeIncreaseQuotaPrivilege 2820 WMIC.exe Token: SeSecurityPrivilege 2820 WMIC.exe Token: SeTakeOwnershipPrivilege 2820 WMIC.exe Token: SeLoadDriverPrivilege 2820 WMIC.exe Token: SeSystemProfilePrivilege 2820 WMIC.exe Token: SeSystemtimePrivilege 2820 WMIC.exe Token: SeProfSingleProcessPrivilege 2820 WMIC.exe Token: SeIncBasePriorityPrivilege 2820 WMIC.exe Token: SeCreatePagefilePrivilege 2820 WMIC.exe Token: SeBackupPrivilege 2820 WMIC.exe Token: SeRestorePrivilege 2820 WMIC.exe Token: SeShutdownPrivilege 2820 WMIC.exe Token: SeDebugPrivilege 2820 WMIC.exe Token: SeSystemEnvironmentPrivilege 2820 WMIC.exe Token: SeRemoteShutdownPrivilege 2820 WMIC.exe Token: SeUndockPrivilege 2820 WMIC.exe Token: SeManageVolumePrivilege 2820 WMIC.exe Token: 33 2820 WMIC.exe Token: 34 2820 WMIC.exe Token: 35 2820 WMIC.exe Token: 36 2820 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3544 wrote to memory of 2820 3544 cmd.exe 84 PID 3544 wrote to memory of 2820 3544 cmd.exe 84 PID 3544 wrote to memory of 3020 3544 cmd.exe 85 PID 3544 wrote to memory of 3020 3544 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bat[1].bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\system32\findstr.exefindstr /i "DADY HARDDISK QEMU HARDDISK WDS100T2B0A"2⤵PID:3020
-