Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
MFAwTjBMMEowSDAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo_X8AUm7+PSp50CDylHxZ86nXBcWJEGuHk_3g==
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
MFAwTjBMMEowSDAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo_X8AUm7+PSp50CDylHxZ86nXBcWJEGuHk_3g==
Resource
win11-20240214-en
windows11-21h2-x64
General
-
Target
MFAwTjBMMEowSDAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo_X8AUm7+PSp50CDylHxZ86nXBcWJEGuHk_3g==
-
Size
1KB
-
MD5
09307b0e931bd0e010ff41d73bfe780b
-
SHA1
6df3947c17c0bdfbdd1d4df9dd09f2fc1a95c2a4
-
SHA256
c0c75997abadfc40c5c76bae8f2b7e63b17e12a7f98a01d857fe839a697c3cbc
-
SHA512
14999287240c8a92aaac8128c136c559d1924ccd62628b8d797059cf747668173d7aa52ff65ac43d3fab8ab1acd1c50674645196db2fc1d50ba7a4d9e361d6bf
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3752 taskmgr.exe Token: SeSystemProfilePrivilege 3752 taskmgr.exe Token: SeCreateGlobalPrivilege 3752 taskmgr.exe Token: 33 3752 taskmgr.exe Token: SeIncBasePriorityPrivilege 3752 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe 3752 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MFAwTjBMMEowSDAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo_X8AUm7+PSp50CDylHxZ86nXBcWJEGuHk_3g==1⤵PID:4076
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3752