Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
210s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2023, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
Core.zip
Resource
win7-20230220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Core.zip
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
AdobePIM.dll
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
AdobePIM.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Core.dll
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Core.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
Core.zip
-
Size
1.1MB
-
MD5
364f0041bbdfbf89c1ba629fa739259c
-
SHA1
75da3c7c1f73537ee8aa69e8d4ae07b30622a5ec
-
SHA256
df135707402bd01bc6a3c10d16f876f25bd16b8a85329687833490cebd9b0051
-
SHA512
1b405658bf4d7bf264b325643edf45f770a3bba24fc6b5ce7b28fd7117c9674d00499d2c1a81d8bbfa854559d72b716038c284fafd71d9d2c65b6da623959592
-
SSDEEP
24576:HcbkDhnYy39SziV9EO4DzNGXqu2UFGkE5+F5ENmq75AN+Hh1Bs7RkWJ73d3h/:8AYy39GQr43NGXEODF5oGN+HDC7vX
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1832 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1832 taskmgr.exe Token: SeSystemProfilePrivilege 1832 taskmgr.exe Token: SeCreateGlobalPrivilege 1832 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe 1832 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Core.zip1⤵PID:2928
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1832