Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TS-240404-TB2.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
120 seconds
Behavioral task
behavioral2
Sample
TS-240404-TB2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
120 seconds
General
-
Target
TS-240404-TB2.exe
-
Size
221KB
-
MD5
16b61a24a6cd3090d1f6210ac9006c7c
-
SHA1
9618960feb88143e056fac81d92719d06b86d8e2
-
SHA256
1bda06eb2ed58ae63e076fd7856133eeb09717e7679c72957de1de7159a575a9
-
SHA512
e43fb244badf332dab1225551a58155bdd85a262bb0041ac282395bf025f48955f6a34aaf3fbcf83b478be82ea5e85a2ce8be41e2f5996a493f2af7bce4c4760
-
SSDEEP
3072:yt5mFQsnQnvgkDwxWzBUEPMZZbude/4v+1IgoWakkgeAHCr1bPpaHI1FeDNAq:q5fsQvgTmBUodLVgoWavsKbP/Y
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1044 StartMenuExperienceHost.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: StartMenuExperienceHost.exe File opened (read-only) \??\Q: StartMenuExperienceHost.exe File opened (read-only) \??\S: StartMenuExperienceHost.exe File opened (read-only) \??\W: StartMenuExperienceHost.exe File opened (read-only) \??\G: StartMenuExperienceHost.exe File opened (read-only) \??\M: StartMenuExperienceHost.exe File opened (read-only) \??\O: StartMenuExperienceHost.exe File opened (read-only) \??\T: StartMenuExperienceHost.exe File opened (read-only) \??\X: StartMenuExperienceHost.exe File opened (read-only) \??\E: StartMenuExperienceHost.exe File opened (read-only) \??\L: StartMenuExperienceHost.exe File opened (read-only) \??\K: StartMenuExperienceHost.exe File opened (read-only) \??\P: StartMenuExperienceHost.exe File opened (read-only) \??\R: StartMenuExperienceHost.exe File opened (read-only) \??\Z: StartMenuExperienceHost.exe File opened (read-only) \??\H: StartMenuExperienceHost.exe File opened (read-only) \??\J: StartMenuExperienceHost.exe File opened (read-only) \??\U: StartMenuExperienceHost.exe File opened (read-only) \??\V: StartMenuExperienceHost.exe File opened (read-only) \??\Y: StartMenuExperienceHost.exe File opened (read-only) \??\B: StartMenuExperienceHost.exe File opened (read-only) \??\I: StartMenuExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe 1044 StartMenuExperienceHost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2760 TS-240404-TB2.exe Token: SeCreateTokenPrivilege 2760 TS-240404-TB2.exe Token: SeAssignPrimaryTokenPrivilege 2760 TS-240404-TB2.exe Token: SeLockMemoryPrivilege 2760 TS-240404-TB2.exe Token: SeIncreaseQuotaPrivilege 2760 TS-240404-TB2.exe Token: SeMachineAccountPrivilege 2760 TS-240404-TB2.exe Token: SeTcbPrivilege 2760 TS-240404-TB2.exe Token: SeSecurityPrivilege 2760 TS-240404-TB2.exe Token: SeTakeOwnershipPrivilege 2760 TS-240404-TB2.exe Token: SeLoadDriverPrivilege 2760 TS-240404-TB2.exe Token: SeSystemProfilePrivilege 2760 TS-240404-TB2.exe Token: SeSystemtimePrivilege 2760 TS-240404-TB2.exe Token: SeProfSingleProcessPrivilege 2760 TS-240404-TB2.exe Token: SeIncBasePriorityPrivilege 2760 TS-240404-TB2.exe Token: SeCreatePagefilePrivilege 2760 TS-240404-TB2.exe Token: SeCreatePermanentPrivilege 2760 TS-240404-TB2.exe Token: SeBackupPrivilege 2760 TS-240404-TB2.exe Token: SeRestorePrivilege 2760 TS-240404-TB2.exe Token: SeShutdownPrivilege 2760 TS-240404-TB2.exe Token: SeDebugPrivilege 2760 TS-240404-TB2.exe Token: SeAuditPrivilege 2760 TS-240404-TB2.exe Token: SeSystemEnvironmentPrivilege 2760 TS-240404-TB2.exe Token: SeChangeNotifyPrivilege 2760 TS-240404-TB2.exe Token: SeRemoteShutdownPrivilege 2760 TS-240404-TB2.exe Token: SeUndockPrivilege 2760 TS-240404-TB2.exe Token: SeSyncAgentPrivilege 2760 TS-240404-TB2.exe Token: SeEnableDelegationPrivilege 2760 TS-240404-TB2.exe Token: SeManageVolumePrivilege 2760 TS-240404-TB2.exe Token: SeImpersonatePrivilege 2760 TS-240404-TB2.exe Token: SeCreateGlobalPrivilege 2760 TS-240404-TB2.exe Token: 31 2760 TS-240404-TB2.exe Token: 32 2760 TS-240404-TB2.exe Token: 33 2760 TS-240404-TB2.exe Token: 34 2760 TS-240404-TB2.exe Token: 35 2760 TS-240404-TB2.exe Token: 36 2760 TS-240404-TB2.exe Token: SeDebugPrivilege 1044 StartMenuExperienceHost.exe Token: SeCreateTokenPrivilege 1044 StartMenuExperienceHost.exe Token: SeAssignPrimaryTokenPrivilege 1044 StartMenuExperienceHost.exe Token: SeLockMemoryPrivilege 1044 StartMenuExperienceHost.exe Token: SeIncreaseQuotaPrivilege 1044 StartMenuExperienceHost.exe Token: SeMachineAccountPrivilege 1044 StartMenuExperienceHost.exe Token: SeTcbPrivilege 1044 StartMenuExperienceHost.exe Token: SeSecurityPrivilege 1044 StartMenuExperienceHost.exe Token: SeTakeOwnershipPrivilege 1044 StartMenuExperienceHost.exe Token: SeLoadDriverPrivilege 1044 StartMenuExperienceHost.exe Token: SeSystemProfilePrivilege 1044 StartMenuExperienceHost.exe Token: SeSystemtimePrivilege 1044 StartMenuExperienceHost.exe Token: SeProfSingleProcessPrivilege 1044 StartMenuExperienceHost.exe Token: SeIncBasePriorityPrivilege 1044 StartMenuExperienceHost.exe Token: SeCreatePagefilePrivilege 1044 StartMenuExperienceHost.exe Token: SeCreatePermanentPrivilege 1044 StartMenuExperienceHost.exe Token: SeBackupPrivilege 1044 StartMenuExperienceHost.exe Token: SeRestorePrivilege 1044 StartMenuExperienceHost.exe Token: SeShutdownPrivilege 1044 StartMenuExperienceHost.exe Token: SeDebugPrivilege 1044 StartMenuExperienceHost.exe Token: SeAuditPrivilege 1044 StartMenuExperienceHost.exe Token: SeSystemEnvironmentPrivilege 1044 StartMenuExperienceHost.exe Token: SeChangeNotifyPrivilege 1044 StartMenuExperienceHost.exe Token: SeRemoteShutdownPrivilege 1044 StartMenuExperienceHost.exe Token: SeUndockPrivilege 1044 StartMenuExperienceHost.exe Token: SeSyncAgentPrivilege 1044 StartMenuExperienceHost.exe Token: SeEnableDelegationPrivilege 1044 StartMenuExperienceHost.exe Token: SeManageVolumePrivilege 1044 StartMenuExperienceHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2760 TS-240404-TB2.exe 1044 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2760 wrote to memory of 1044 2760 TS-240404-TB2.exe 98 PID 2760 wrote to memory of 1044 2760 TS-240404-TB2.exe 98 PID 2760 wrote to memory of 1044 2760 TS-240404-TB2.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\TS-240404-TB2.exe"C:\Users\Admin\AppData\Local\Temp\TS-240404-TB2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\ProgramData\StartMenuExperienceHost.exe"C:\ProgramData\StartMenuExperienceHost.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD516b61a24a6cd3090d1f6210ac9006c7c
SHA19618960feb88143e056fac81d92719d06b86d8e2
SHA2561bda06eb2ed58ae63e076fd7856133eeb09717e7679c72957de1de7159a575a9
SHA512e43fb244badf332dab1225551a58155bdd85a262bb0041ac282395bf025f48955f6a34aaf3fbcf83b478be82ea5e85a2ce8be41e2f5996a493f2af7bce4c4760