Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 21:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xagent64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Xagent64.dll
-
Size
276KB
-
MD5
cc9e6578a47182a941a478b276320e06
-
SHA1
0b3852ae641df8ada629e245747062f889b26659
-
SHA256
fd39d2837b30e7233bc54598ff51bdc2f8c418fa5b94dea2cadb24cf40f395e5
-
SHA512
6cc6bdd0edd4b14d7f87b6c8a91cb563b7a2b1e6e2d26357b77c50e1c22a451e64a3224e6c8307623e44b626ba47d0c179114bf1137a453ab2f8ae61425a1659
-
SSDEEP
3072:0TrTaRcOsbAZo/DWEx9SYCTfyTcCuUtBwXO1HYF9GQkgYKON4hz46Gyi:+rT4cL/l9lofyTmUtBwX64FgKdhxGy
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 10 4836 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2756 taskmgr.exe Token: SeSystemProfilePrivilege 2756 taskmgr.exe Token: SeCreateGlobalPrivilege 2756 taskmgr.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe 2756 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Xagent64.dll,#11⤵
- Blocklisted process makes network request
PID:4836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756