Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    35s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 17:03

General

  • Target

    WizWorm.exe

  • Size

    14.3MB

  • MD5

    ee37a918d746512afa8e35109f6d8b85

  • SHA1

    f98359a420af803fb7ba9941ea719dad39bea2a7

  • SHA256

    02f104af2be304ea240158bfb8200ed782884a3eeadcaee50e706849651ee08f

  • SHA512

    db80db4bf2094d33824078e876b23a3374929663cfe83eed507f2029910a2ae5d32b8f38aaca3b54a15c1148ae8e2b7ed706bdadfdf4a6dfc7f8a94f97ab1160

  • SSDEEP

    393216:83vfM+4cdgLNLmpDz05h8HpCLemOEkHh1og2CrVJCmvc:83vfM+4cCm25hspRmIAWvH

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WizWorm.exe
    "C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"
    1⤵
      PID:1652
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4500

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1652-0-0x000002B2563D0000-0x000002B257224000-memory.dmp

      Filesize

      14.3MB

    • memory/1652-1-0x00007FFE93EA0000-0x00007FFE94961000-memory.dmp

      Filesize

      10.8MB

    • memory/1652-2-0x000002B258E80000-0x000002B258E90000-memory.dmp

      Filesize

      64KB

    • memory/1652-3-0x000002B2717C0000-0x000002B2729B2000-memory.dmp

      Filesize

      17.9MB

    • memory/1652-4-0x00007FFE93EA0000-0x00007FFE94961000-memory.dmp

      Filesize

      10.8MB

    • memory/4500-6-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-5-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-7-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-12-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-11-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-13-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-14-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-15-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-16-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB

    • memory/4500-17-0x000001B5BC8D0000-0x000001B5BC8D1000-memory.dmp

      Filesize

      4KB