Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 16:44

General

  • Target

    hl2.exe

  • Size

    104KB

  • MD5

    7c271bbd974c760f516f1c9f9b61e0f2

  • SHA1

    a1c9b9f1a9cc568ed707d880f78d16ce6d60ab4f

  • SHA256

    4a06de84351ffbccc9bb1575c21142074c240f54902557e13e40ba037976d25f

  • SHA512

    f640b9f1eea0e5374522da490bd318bd17528f12d85ef1bd1566594c0d645de11cd1449fceadaa6751540dc95b2b3599b38a32f9bfa5700d75d81989095935e8

  • SSDEEP

    1536:hXRI3bwH4YFDLkqwaif9vk39HNJ24F8ikWjlnX7X5XYZXP/b1:zIraLLkqFlN8biLjlnLJI//b

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hl2.exe
    "C:\Users\Admin\AppData\Local\Temp\hl2.exe"
    1⤵
      PID:3508
    • C:\Windows\System32\GameBarPresenceWriter.exe
      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
      1⤵
        PID:4168
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3412
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        PID:4808
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2456,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
        1⤵
          PID:3832
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
          1⤵
          • Checks processor information in registry
          • Modifies registry class
          PID:2500

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Videos\Captures\desktop.ini

          Filesize

          190B

          MD5

          b0d27eaec71f1cd73b015f5ceeb15f9d

          SHA1

          62264f8b5c2f5034a1e4143df6e8c787165fbc2f

          SHA256

          86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

          SHA512

          7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c