Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1764s -
max time network
1622s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
1800 seconds
Behavioral task
behavioral2
Sample
de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
1800 seconds
General
-
Target
de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe
-
Size
794KB
-
MD5
4b0994f79c4f20c8a121d5a2b53caf84
-
SHA1
1f02d9751edea6a50fea3ed671fe6355ca0ba2d8
-
SHA256
de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d
-
SHA512
c6ace568997edae890635d71f53f71c006b27771ca04de8ed900f617eb34c96aa3d689d242787d1b486a4eb863b73d3d422bc94c4ce164637de7c026f958acf4
-
SSDEEP
12288:aH4q/W7id7BUm5rKfq3wAFFumGoDzAqrhYRP8XAMk8rH4qfvb:aHRe7i7UImkvjgR8A0rHRfvb
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4912 4576 WerFault.exe 104 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000030000000200000000000000ffffffff regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202 regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000 regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9 regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "9" regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Documents" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" regedit.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU regedit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff regedit.exe -
Runs regedit.exe 1 IoCs
pid Process 5012 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5012 regedit.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4984 taskmgr.exe Token: SeSystemProfilePrivilege 4984 taskmgr.exe Token: SeCreateGlobalPrivilege 4984 taskmgr.exe Token: 33 4984 taskmgr.exe Token: SeIncBasePriorityPrivilege 4984 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3156 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 2088 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 2628 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 4576 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3156 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 3156 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 2088 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 2088 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 2628 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 2628 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 4576 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 4576 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 4576 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 5012 regedit.exe 5012 regedit.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3156 wrote to memory of 2088 3156 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 89 PID 3156 wrote to memory of 2088 3156 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 89 PID 3156 wrote to memory of 2088 3156 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 89 PID 2088 wrote to memory of 2628 2088 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 92 PID 2088 wrote to memory of 2628 2088 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 92 PID 2088 wrote to memory of 2628 2088 de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe" /retrynav 12⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe" /retrynav 23⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"C:\Users\Admin\AppData\Local\Temp\de9a418e56df6ff0e076ce40033ea7e3295dcf1a28b934ee002fe76707efe58d.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 20162⤵
- Program crash
PID:4912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 45761⤵PID:3016
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4984
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Modifies registry class
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5012