Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

rufus-4.4.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/02/2024, 19:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rufus-4.4.exe

  • Size

    1.4MB

  • MD5

    7a4662bb7f331d2252f3d949657d821d

  • SHA1

    ad53fddfbcead7b3e6c322c0aad8c4a826bd4967

  • SHA256

    42cdb16f6dd64c4fec30c7a71960fe4d0015862c37e7b02c8dba5c0d68384c74

  • SHA512

    a1d111fc91cd470d36bd4640884b3550c6a4035e8c5bc5176dc9f67aa2ef8be6fc12956d0b351c272d8bb89646546dac868b32d1d1985dee86ffb6e971b14f3f

  • SSDEEP

    24576:wOyBSB04yZT5Z6iqUbVEMs6MrhXlPrBnr/TwcEgzXIdVWLpuL94q:XgZT5ZSU1fUhXhrBnbTbaAIt

Score
7/10
evasiontrojanupx

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 17 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rufus-4.4.exe
    "C:\Users\Admin\AppData\Local\Temp\rufus-4.4.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2164
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:420
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3728
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:3240
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
        1⤵
          PID:2068

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2164-0-0x00007FF760930000-0x00007FF760D0F000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/2164-11-0x00007FF760930000-0x00007FF760D0F000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/2164-26-0x00007FF760930000-0x00007FF760D0F000-memory.dmp

          Filesize

          3.9MB

          Download

        • memory/2164-31-0x00007FF760930000-0x00007FF760D0F000-memory.dmp

          Filesize

          3.9MB

          Download