Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
Free Cheats.url
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Free Cheats.url
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Free Hacks.url
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Free Hacks.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Free Cheats.url
-
Size
112B
-
MD5
ba5fbb2a8152c55a72e671550c24c0f3
-
SHA1
b484d287e062c3a26f2f439d460d90ebbac7fa98
-
SHA256
042bd1ac74a622aabe83c60b74c0813a2303903080ac82614c535c97d4db5ad2
-
SHA512
3041b66791e7b2ff63ade425ff2e9f10c212abee7d1c1fb34de72b07892b2e35650df4ebf494df9b6937f99e9d81a95e46c0849ef7caf329ef2881f2b102c5a2
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2916 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2916 taskmgr.exe Token: SeSystemProfilePrivilege 2916 taskmgr.exe Token: SeCreateGlobalPrivilege 2916 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Free Cheats.url"1⤵PID:3252
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:232
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2916