Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 15:02

General

  • Target

    pcsx2.exe

  • Size

    9.7MB

  • MD5

    8ea60a3fb6ada3f42a15efa9c1c320b4

  • SHA1

    ccd5af8264b25dff8aac3026784ae7a748b8220b

  • SHA256

    e387c713005082a19db33f4e163a7f48671c1f9ea06bfd76c6f120b246043e59

  • SHA512

    635fd2e2b1770111b3890684b1eaf37810bcda4896c21da7cbf6046cc262a409feb9141f97e54d70b18dd43e483fa336eafd933ea1850989107df2c5f4291bc4

  • SSDEEP

    98304:Qdc297FRw8ztmkAxL27GUH5OBchpORYQPqr2LweFPBnsbcNQP9aehOsKl8:QdcjBkXAYQSSLygy17UsX

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pcsx2.exe
    "C:\Users\Admin\AppData\Local\Temp\pcsx2.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3360
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3920
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Modifies registry class
    PID:3096
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
    1⤵
    • Checks processor information in registry
    • Modifies registry class
    PID:2116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Videos\Captures\desktop.ini

    Filesize

    190B

    MD5

    b0d27eaec71f1cd73b015f5ceeb15f9d

    SHA1

    62264f8b5c2f5034a1e4143df6e8c787165fbc2f

    SHA256

    86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

    SHA512

    7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c