Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
796s -
max time network
648s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system -
submitted
19/02/2024, 17:59
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft PID Checker/Microsoft PID Checker.exe
Resource
win10-20240214-en
Behavioral task
behavioral2
Sample
Microsoft PID Checker/Microsoft PID Checker.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Microsoft PID Checker/ProductKeyUtilities.dll
Resource
win10-20240214-en
Behavioral task
behavioral4
Sample
Microsoft PID Checker/ProductKeyUtilities.dll
Resource
win10v2004-20231215-en
General
-
Target
Microsoft PID Checker/Microsoft PID Checker.exe
-
Size
10.6MB
-
MD5
2c544f4b1a38f88bb994f0dfa8086806
-
SHA1
f3fff5624015ce70c0f2e0dc170be94b52ab72f3
-
SHA256
d62a5168dee0927fe69d84d2b3521871be2881dc645d7ea10b485e503316ea73
-
SHA512
71ccb63c0e8d3f17335be0d78544448cfd951a641e4f899386437a6af49dede9d1bd2a319a1303c2516768f60683c6af67e52d3237de31b3b06ac9d476a03a78
-
SSDEEP
24576:DgqSboEPwUX4st0WUhMfu2S8RwD4+6QpI2grJ/TAegXuvQSiker0q48Fli/ajLs3:DgqqwJr0D1wXS2g1LZJHnIndasG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Microsoft PID Checker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Microsoft PID Checker.exe -
Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Microsoft PID Checker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Microsoft PID Checker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Microsoft PID Checker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Microsoft PID Checker.exe Key created \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Microsoft PID Checker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Microsoft PID Checker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529921725-1823547078-1350365960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Microsoft PID Checker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 Microsoft PID Checker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1488 Microsoft PID Checker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft PID Checker\Microsoft PID Checker.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft PID Checker\Microsoft PID Checker.exe"1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
995KB
MD54f2dade1bf4871558ccb974d2f99a32b
SHA136cdaf38fa3201980a2e4cd923bb347ec8e5864b
SHA2568722ac6d9a224ac7daa13c8f6a68b38b557cf3e71c5c500b2fdcf8c873f0c6f0
SHA5125d9cb8f51af110a23ec160e30e4ce55066e453b8acf1d5fc4e93471f3e60f3a086bd44d616f6c27f90632f42b3eae7b127c9736d9925ef2e078d521c6c68d66d