Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 11:57
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v2004-20220812-en
4 signatures
150 seconds
General
-
Target
PO.exe
-
Size
256KB
-
MD5
fdb600278c1a88593ac1a179c65065a4
-
SHA1
a389f85db04d1294c311cfe9f02d3e57a831bf4f
-
SHA256
c90eeb85f1171dfbeb87695b25a86843c070c413d43a546ad1a5d1997246e2ac
-
SHA512
bc9175fd7e846c65dcd7e5c8f8ced7c2a5275158fe2d8a5829e60e8956348e31c1ae4e2a4a391d5393bdda2dbb5dbe02889a67f2ec94c9c2fa53a8826f60398b
-
SSDEEP
768:pMOsshuxpc/yBuP2Nm7mCs6bdCjquRr5R555t:plhuxpcR2qhs6pYT
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{79ED775D-8C5B-4017-BC4D-8BF5313C017F}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0FE3858B-EE24-429C-94D0-A917EA769BF6}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1404 PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3880