Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
UltraHook/Rinput.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
UltraHook/Rinput.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
UltraHook/uh.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
UltraHook/uh.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
hl2.exe
Resource
win10v2004-20240508-en
General
-
Target
hl2.exe
-
Size
104KB
-
MD5
7c271bbd974c760f516f1c9f9b61e0f2
-
SHA1
a1c9b9f1a9cc568ed707d880f78d16ce6d60ab4f
-
SHA256
4a06de84351ffbccc9bb1575c21142074c240f54902557e13e40ba037976d25f
-
SHA512
f640b9f1eea0e5374522da490bd318bd17528f12d85ef1bd1566594c0d645de11cd1449fceadaa6751540dc95b2b3599b38a32f9bfa5700d75d81989095935e8
-
SSDEEP
1536:hXRI3bwH4YFDLkqwaif9vk39HNJ24F8ikWjlnX7X5XYZXP/b1:zIraLLkqFlN8biLjlnLJI//b
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{C430D63D-3C28-4BA7-A9BD-A6DCF25E3521} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{F0B5773E-D684-467D-AFD7-211D1FC82DAA} svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3412 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hl2.exe"C:\Users\Admin\AppData\Local\Temp\hl2.exe"1⤵PID:3508
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:4168
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2456,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:81⤵PID:3832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c