Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2023, 22:00

General

  • Target

    PsychEngine.exe

  • Size

    26.8MB

  • MD5

    9916e2b755bf0637aa3069c007f2b0eb

  • SHA1

    f4d3297d226142acca9231633dc8a624c9e16999

  • SHA256

    e7e47700c7de3761e90114e8ae9a7d2bd53bcf314d7aef66ce3bde6f0081dfac

  • SHA512

    9978e7321db64444b61a55db5263e215c54b423004398df82f98ab5f06a99be90fb0259f1eb4707d3965cdd322c2bddd249e381a382768a698798e2eaf9689a2

  • SSDEEP

    393216:1X7fdt85cfn+mSyUC3XiL34mh3ULZykQn:Tkb463ULZyk

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 3 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\PsychEngine.exe
    "C:\Users\Admin\AppData\Local\Temp\PsychEngine.exe"
    1⤵
      PID:640
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs -p
      1⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:1152

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\wsu9D69.tmp

      Filesize

      14KB

      MD5

      c01eaa0bdcd7c30a42bbb35a9acbf574

      SHA1

      0aee3e1b873e41d040f1991819d0027b6cc68f54

      SHA256

      32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

      SHA512

      d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7