Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 10:33
Behavioral task
behavioral1
Sample
Woofer.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Woofer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Woofer.exe
-
Size
549KB
-
MD5
21c1702313e421b17d293723f09931eb
-
SHA1
c9a05ab02ee5c05236256063cd14c424a1402cc4
-
SHA256
fb3d91b13118a2806a504dee22ad186971ea0be2189f43465adf0fe54f118abb
-
SHA512
23d8377ef63df16ce0589d5d6552dfea752f4e89359d69ef54543a7a8fc6ac2ceee647886ab30c541e1a793ddef8138cb7112a8740296fc8c1adefa4ee3691fe
-
SSDEEP
12288:2YU8UoaQn65KH4lczp9f+2k0FQPgJtYlHW7tQJU6hiB:FUoa53q7k0aPgrYlKKhiB
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4248-1-0x00000000000C0000-0x00000000001A0000-memory.dmp vmprotect -
Program crash 1 IoCs
pid pid_target Process procid_target 4800 4248 WerFault.exe 96 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2356 taskmgr.exe Token: SeSystemProfilePrivilege 2356 taskmgr.exe Token: SeCreateGlobalPrivilege 2356 taskmgr.exe Token: 33 2356 taskmgr.exe Token: SeIncBasePriorityPrivilege 2356 taskmgr.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe 2356 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Woofer.exe"C:\Users\Admin\AppData\Local\Temp\Woofer.exe"1⤵PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 13882⤵
- Program crash
PID:4800
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4248 -ip 42481⤵PID:4184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:3848