Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
269s -
max time network
247s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2023, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
whaql.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
whaql.exe
-
Size
9KB
-
MD5
5908765d5c57c2e9a32e5e5418babe07
-
SHA1
e169a040857941e9f2d063c12de4b31191a5a8e3
-
SHA256
cdffda0b07c3a52f1d61e78ff2279996ee4db1edb1e32f6648061d35cca0bf71
-
SHA512
0a86a8b03c378492c5927526355c1f81bcf27554e39afdbb38a26bc55238147fc048de852b324f84ec38baf0e4aa147c25b28e0806f38c7be452d47775932fe3
-
SSDEEP
192:E/TbyXsdlhT5svkOwxb47E5pz6fqbKua:6OXsdf5svkOwV47KKu
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1340 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1340 taskmgr.exe Token: SeSystemProfilePrivilege 1340 taskmgr.exe Token: SeCreateGlobalPrivilege 1340 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe 1340 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2796 wrote to memory of 4988 2796 whaql.exe 83 PID 2796 wrote to memory of 4988 2796 whaql.exe 83 PID 2796 wrote to memory of 4988 2796 whaql.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\whaql.exe"C:\Users\Admin\AppData\Local\Temp\whaql.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:4988
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1340