Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VBucks_Generator.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
VBucks_Generator.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
VBucks_Generator.exe
-
Size
1.4MB
-
MD5
61bf523841a04dbad1338049c1705ede
-
SHA1
056b069890352755222d261b6de4d1436be7f871
-
SHA256
1aa8a2866b28cb93abde5096e389d725198d83162f0ddcdbb327101b7bd1e5e7
-
SHA512
e723a076ce6603168cadee9356956ab959f0098ef30939db747e9ead43457f347177551f9ea97d26476173ed029d97e4d2a7a10ce866d38531ccf9cab1e50097
-
SSDEEP
24576:yD7Xr5my0DPP23Iy5YAmRW6B8If0s83I4eqowSwa1X9tqY7Jxiqra:yD7Xroy0DPP23Iy5YAmw6B8If0F3IwoW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 VBucks_Generator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 VBucks_Generator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 VBucks_Generator.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1676 VBucks_Generator.exe 292 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 292 taskmgr.exe Token: SeShutdownPrivilege 292 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1676 VBucks_Generator.exe 1676 VBucks_Generator.exe 1676 VBucks_Generator.exe 1676 VBucks_Generator.exe 1676 VBucks_Generator.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe -
Suspicious use of SendNotifyMessage 63 IoCs
pid Process 1676 VBucks_Generator.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe 292 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VBucks_Generator.exe"C:\Users\Admin\AppData\Local\Temp\VBucks_Generator.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1676
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1908
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:292
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06