Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04/05/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
kys.vbs
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
General
-
Target
kys.vbs
-
Size
620B
-
MD5
b552871cbf0699ededab2c0dcade7bf4
-
SHA1
151d992dce7860c5c3d940bf1260014a7f9049a3
-
SHA256
e4a05ad120aa6f6248a13bcb610d2704576eb5a75ced4afebf2bf1353d81d956
-
SHA512
691f02ef5beaf6cc8879dda8f7244f10e2caae464737a160f2f9459fafbcfc4c7ad2459e4c7f9a4756679f47b737365d22fb637a16b3ab11e009b07a36bee049
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1328 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1328 taskmgr.exe Token: SeSystemProfilePrivilege 1328 taskmgr.exe Token: SeCreateGlobalPrivilege 1328 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe 1328 taskmgr.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kys.vbs"1⤵PID:5032
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1328
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
620B
MD5b552871cbf0699ededab2c0dcade7bf4
SHA1151d992dce7860c5c3d940bf1260014a7f9049a3
SHA256e4a05ad120aa6f6248a13bcb610d2704576eb5a75ced4afebf2bf1353d81d956
SHA512691f02ef5beaf6cc8879dda8f7244f10e2caae464737a160f2f9459fafbcfc4c7ad2459e4c7f9a4756679f47b737365d22fb637a16b3ab11e009b07a36bee049