Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
lt5d3x20.tji.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
60 seconds
Behavioral task
behavioral2
Sample
lt5d3x20.tji.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
60 seconds
General
-
Target
lt5d3x20.tji.exe
-
Size
3.6MB
-
MD5
fb2fbbca2f0544daf76de3f8a37acd58
-
SHA1
5975852f38e1eac10b3564d3e8ffbdc19a14cedc
-
SHA256
4b9356c42977c701ea89c791e4bf74ef27559e856d9349126dbd3cb0ebc9fe83
-
SHA512
dd152cf683ba1e7278ed60c080d66ce9533ca4300183efda0b4b95ac712f35e7f83778f227cab004aa9b90fd3bbeed2bd291870d66680c8bec5c0e8a5acc55ab
-
SSDEEP
98304:cz9uhwD65EIeWBnkUxdMCCy9xlNUQCkDpTk21ZYzvCoJmvZmhL9wUHKT7ayB8z93:cJOwDcBnbH9VUM6qw9wWKPN8Lq0
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3800 taskmgr.exe Token: SeSystemProfilePrivilege 3800 taskmgr.exe Token: SeCreateGlobalPrivilege 3800 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lt5d3x20.tji.exe"C:\Users\Admin\AppData\Local\Temp\lt5d3x20.tji.exe"1⤵PID:3664
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4944