Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
45s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18/10/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
Graphs_V2.bat
Resource
win10-20240611-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Graphs_V2.bat
Resource
win10-20240404-en
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
Graphs_V2.bat
-
Size
2KB
-
MD5
357d5768e2f7c4ec0c2a164a836174e1
-
SHA1
a5766c3cf5fac836f60a4663c3f0f0ab1b8cb280
-
SHA256
f2fd0f2ef17ebcbe8389d9efdc61cafccf587d6fcdab08a5760cf346401b9794
-
SHA512
bbf1fccfa50eeee15213e44803d2a77e49632be72c6f87be4a51a65e6ba5603559f0eca529d44aa0584040e8d2df724184e5217714ea1ce1f23869b7ab293ca3
Score
1/10
Malware Config
Signatures
-
Delays execution with timeout.exe 6 IoCs
pid Process 2012 timeout.exe 5004 timeout.exe 656 timeout.exe 1780 timeout.exe 1148 timeout.exe 5032 timeout.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3600 shutdown.exe Token: SeRemoteShutdownPrivilege 3600 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4912 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 4660 2856 cmd.exe 74 PID 2856 wrote to memory of 4660 2856 cmd.exe 74 PID 2856 wrote to memory of 1836 2856 cmd.exe 76 PID 2856 wrote to memory of 1836 2856 cmd.exe 76 PID 2856 wrote to memory of 696 2856 cmd.exe 77 PID 2856 wrote to memory of 696 2856 cmd.exe 77 PID 2856 wrote to memory of 936 2856 cmd.exe 80 PID 2856 wrote to memory of 936 2856 cmd.exe 80 PID 2856 wrote to memory of 3632 2856 cmd.exe 81 PID 2856 wrote to memory of 3632 2856 cmd.exe 81 PID 2856 wrote to memory of 3628 2856 cmd.exe 82 PID 2856 wrote to memory of 3628 2856 cmd.exe 82 PID 2856 wrote to memory of 196 2856 cmd.exe 83 PID 2856 wrote to memory of 196 2856 cmd.exe 83 PID 2856 wrote to memory of 312 2856 cmd.exe 84 PID 2856 wrote to memory of 312 2856 cmd.exe 84 PID 2856 wrote to memory of 888 2856 cmd.exe 85 PID 2856 wrote to memory of 888 2856 cmd.exe 85 PID 2856 wrote to memory of 884 2856 cmd.exe 87 PID 2856 wrote to memory of 884 2856 cmd.exe 87 PID 2856 wrote to memory of 928 2856 cmd.exe 88 PID 2856 wrote to memory of 928 2856 cmd.exe 88 PID 2856 wrote to memory of 2500 2856 cmd.exe 89 PID 2856 wrote to memory of 2500 2856 cmd.exe 89 PID 2856 wrote to memory of 764 2856 cmd.exe 90 PID 2856 wrote to memory of 764 2856 cmd.exe 90 PID 2856 wrote to memory of 4196 2856 cmd.exe 92 PID 2856 wrote to memory of 4196 2856 cmd.exe 92 PID 2856 wrote to memory of 3840 2856 cmd.exe 93 PID 2856 wrote to memory of 3840 2856 cmd.exe 93 PID 2856 wrote to memory of 716 2856 cmd.exe 94 PID 2856 wrote to memory of 716 2856 cmd.exe 94 PID 2856 wrote to memory of 1332 2856 cmd.exe 95 PID 2856 wrote to memory of 1332 2856 cmd.exe 95 PID 2856 wrote to memory of 3604 2856 cmd.exe 96 PID 2856 wrote to memory of 3604 2856 cmd.exe 96 PID 2856 wrote to memory of 3336 2856 cmd.exe 97 PID 2856 wrote to memory of 3336 2856 cmd.exe 97 PID 2856 wrote to memory of 4588 2856 cmd.exe 98 PID 2856 wrote to memory of 4588 2856 cmd.exe 98 PID 2856 wrote to memory of 2336 2856 cmd.exe 99 PID 2856 wrote to memory of 2336 2856 cmd.exe 99 PID 2856 wrote to memory of 4740 2856 cmd.exe 100 PID 2856 wrote to memory of 4740 2856 cmd.exe 100 PID 2856 wrote to memory of 5104 2856 cmd.exe 101 PID 2856 wrote to memory of 5104 2856 cmd.exe 101 PID 2856 wrote to memory of 4180 2856 cmd.exe 102 PID 2856 wrote to memory of 4180 2856 cmd.exe 102 PID 2856 wrote to memory of 656 2856 cmd.exe 103 PID 2856 wrote to memory of 656 2856 cmd.exe 103 PID 2856 wrote to memory of 2172 2856 cmd.exe 104 PID 2856 wrote to memory of 2172 2856 cmd.exe 104 PID 2856 wrote to memory of 4472 2856 cmd.exe 105 PID 2856 wrote to memory of 4472 2856 cmd.exe 105 PID 2856 wrote to memory of 352 2856 cmd.exe 106 PID 2856 wrote to memory of 352 2856 cmd.exe 106 PID 2856 wrote to memory of 1780 2856 cmd.exe 107 PID 2856 wrote to memory of 1780 2856 cmd.exe 107 PID 2856 wrote to memory of 1924 2856 cmd.exe 108 PID 2856 wrote to memory of 1924 2856 cmd.exe 108 PID 2856 wrote to memory of 1956 2856 cmd.exe 109 PID 2856 wrote to memory of 1956 2856 cmd.exe 109 PID 2856 wrote to memory of 1556 2856 cmd.exe 110 PID 2856 wrote to memory of 1556 2856 cmd.exe 110
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Graphs_V2.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\cmd.execmd2⤵PID:4660
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1836
-
-
C:\Windows\system32\cmd.execmd2⤵PID:696
-
-
C:\Windows\system32\cmd.execmd2⤵PID:936
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3632
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:3628
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:196
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:312
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:888
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:884
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:928
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:2500
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:764
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:4196
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:3840
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:716
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:1332
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:3604
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:3336
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:4588
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:2336
-
-
C:\Windows\system32\msg.exemsg * Your computer has a virus!2⤵PID:4740
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:5104
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:4180
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:656
-
-
C:\Windows\system32\msg.exemsg * I'm sorry for the inconvenience...2⤵PID:2172
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:4472
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:352
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:1780
-
-
C:\Windows\system32\msg.exemsg * But your computer will die in one minute...2⤵PID:1924
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:1956
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:1556
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:1148
-
-
C:\Windows\system32\msg.exemsg * don't Forget to save your files!2⤵PID:4932
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:5016
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:4436
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:5032
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2088
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:5024
-
-
C:\Windows\system32\notepad.exenotepad2⤵PID:3312
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:2012
-
-
C:\Windows\system32\msg.exemsg * But your computer will still shutdown in a minute so please save your files!2⤵PID:2352
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:5004
-
-
C:\Windows\system32\msg.exemsg * okay bye!2⤵PID:1108
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2416
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2916
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3880
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1064
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4956
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2296
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1000
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2644
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4944
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4872
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4848
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4628
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4532
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2816
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2548
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2408
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4232
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2516
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4844
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1932
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3744
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2536
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4148
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2920
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:656
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2172
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1780
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1924
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1148
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4932
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4912
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3440
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3812
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4100
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2256
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2672
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3488
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2416
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4940
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:772
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2092
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3856
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2296
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4208
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:3012
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4944
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4292
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4868
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:1936
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2900
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:832
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4480
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2408
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:2404
-
-
C:\Windows\system32\msg.exemsg * You just got pranked XD!2⤵PID:4092
-
-
C:\Windows\system32\shutdown.exeshutdown /s2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ae6855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4912