Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/03/2024, 17:00
240328-vjge6sca89 328/03/2024, 16:59
240328-vhkq7sbb7x 328/03/2024, 16:56
240328-vf6wnabb4y 3Analysis
-
max time kernel
48s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
spotify.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
spotify.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
spotify.exe
-
Size
1.8MB
-
MD5
d14412f37ddcfb79a8459c9cffe61141
-
SHA1
c8e3e9db1075225f04aa1f1c78af82933a7aefbe
-
SHA256
1f28d9c1156ed51daa3b0a0c2e29d8a8a487213bc315b25b209aebb2a6d276d7
-
SHA512
6f3eb853c74496d2f0ea2b8bc3a5db582b6d82e6a805b92205c6a0e8abd88c60b405ff43cd70eda32517a55c760e311684b81c25a48ef49fb9b972ee50a47ad8
-
SSDEEP
24576:eSPMKv6qBxfcremN3ORRkyUV3mrvO3coz1hQiZKHT10OOfnFZ/XDe1n7Ji9:eSEC6qBng3tyfmco5mHnynFZ9
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5004 taskmgr.exe Token: SeSystemProfilePrivilege 5004 taskmgr.exe Token: SeCreateGlobalPrivilege 5004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe 5004 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\spotify.exe"C:\Users\Admin\AppData\Local\Temp\spotify.exe"1⤵PID:4864
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5004
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4312