Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2023, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
GeometryDash.exe
Resource
win7-20220901-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
GeometryDash.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
GeometryDash.exe
-
Size
6.5MB
-
MD5
f7eaf3d6e142e5133ad74368e67c8450
-
SHA1
d93a40aacd63226f754f3a0898b82a28298d79f4
-
SHA256
57a27ed946f1d7cc08bf632f5df3dc877c748b1cc06515619cf4a713c628fa3c
-
SHA512
3c47b26e41d43646fb20b9b2b9b08aeb31497754f603cdf037db375ce6a6f5762d3a29f7022622dd7204ea37560bcdde6ede6add5e7f3b1f8bda236da9a7dac9
-
SSDEEP
98304:hTuDNeoQyVe2BVBdJlRtZ1h9QVxfS+VxfSgrw:oeWYLfLZw
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2256 4888 WerFault.exe 34 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1812 taskmgr.exe Token: SeSystemProfilePrivilege 1812 taskmgr.exe Token: SeCreateGlobalPrivilege 1812 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"1⤵PID:4436
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 4888 -ip 48881⤵PID:4528
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4888 -s 24641⤵
- Program crash
PID:2256
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1812