Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
76s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
autoit3.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
autoit3.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
rsa2.au3
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral4
Sample
rsa2.au3
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
autoit3.exe
-
Size
872KB
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
-
SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417
-
SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
-
SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
SSDEEP
12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3336 taskmgr.exe Token: SeSystemProfilePrivilege 3336 taskmgr.exe Token: SeCreateGlobalPrivilege 3336 taskmgr.exe Token: 33 3336 taskmgr.exe Token: SeIncBasePriorityPrivilege 3336 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe 3336 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\autoit3.exeC:\Users\Admin\AppData\Local\Temp\autoit3.exe autoit3.exe rsa2.au31⤵PID:2864
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3336