Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2024, 21:13

General

  • Target

    HandBrake.exe

  • Size

    35.6MB

  • MD5

    ee3cbf592c24b1bf04d906ded5c7d1a9

  • SHA1

    1931bdd5d120635c357b3000dff08ec9110ce1e3

  • SHA256

    ee818fe194c29f1f31d6edffeb8256405618dab251f3765bbbacfb91ea666336

  • SHA512

    97b52abf6cab8540bb7e6467eddaf02199c34fb40eb561ee022e626f9976e9a6d5b1006d053f2f1234c4a8760d686a6dfece1c5fd25483ff2d67bae43e38d8ac

  • SSDEEP

    196608:cGSU8sdauO4miemcjYXCe5njhhKt39VxwgTluwKqVWyAAh:1SybLnJX/9jhhKtNDwgTluwKo5

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HandBrake.exe
    "C:\Users\Admin\AppData\Local\Temp\HandBrake.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\HandBrake\settings.json

    Filesize

    1KB

    MD5

    064807540e2e268c6e434da9e6205528

    SHA1

    a6019147747e46c9ab689a167de0fb1d622e564e

    SHA256

    8c1ec733778ca66505ef7afa77b0ac335db7a1a381e77492fbde37d53d33073e

    SHA512

    c251463b096d68445754cbe732be13697aa59383e004858c49ab743fc971597ff63d7930800e7080cb10dc611250a81aba7b2b9236f705dae60bda4e2207b244

  • C:\Users\Admin\AppData\Roaming\HandBrake\settings.json

    Filesize

    1KB

    MD5

    1b3980a81eed4a54741aa088924dd6d2

    SHA1

    852855903c8063a5f917ee3b02d0fc862b24bd49

    SHA256

    42acbbde0eb4336f6015151faa965c93b7924544ee4445d26069ae8d4530c07a

    SHA512

    6d046d276c72e6fe2e06a6b0fa2c44c2bf47e9293a9b914915cbc2a161b6e7c0b37bc31d43328c6392e2c9496144cb746f381ce0e5f21a8bf25b7ad8b9dde35c

  • memory/4416-16-0x0000026BEAEF0000-0x0000026BEAEFD000-memory.dmp

    Filesize

    52KB

  • memory/4416-7-0x0000026BEAFA0000-0x0000026BEB072000-memory.dmp

    Filesize

    840KB

  • memory/4416-10-0x0000026BE9250000-0x0000026BE9293000-memory.dmp

    Filesize

    268KB

  • memory/4416-13-0x0000026BEAF30000-0x0000026BEAF8A000-memory.dmp

    Filesize

    360KB

  • memory/4416-0-0x00007FFBAEBE0000-0x00007FFBAF0DE000-memory.dmp

    Filesize

    5.0MB

  • memory/4416-4-0x0000026BEB310000-0x0000026BEB750000-memory.dmp

    Filesize

    4.2MB

  • memory/4416-1-0x0000000180000000-0x00000001802B4000-memory.dmp

    Filesize

    2.7MB

  • memory/4416-89-0x0000026BEBF70000-0x0000026BEC03E000-memory.dmp

    Filesize

    824KB

  • memory/4416-92-0x0000026BEC640000-0x0000026BEC693000-memory.dmp

    Filesize

    332KB

  • memory/4416-96-0x0000026BE8BD0000-0x0000026BE8C23000-memory.dmp

    Filesize

    332KB

  • memory/4416-99-0x0000026BEC730000-0x0000026BEC7B8000-memory.dmp

    Filesize

    544KB

  • memory/4416-102-0x00007FFB97B70000-0x00007FFB9D539000-memory.dmp

    Filesize

    89.8MB

  • memory/4416-104-0x00007FFBAEBE0000-0x00007FFBAF0DE000-memory.dmp

    Filesize

    5.0MB