Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 13:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
48KB
-
MD5
3668e97d95b35672e4a8eb7cb1da1cf5
-
SHA1
2dc3e500ac21d9c07af38e5f70f83ec7bc30bace
-
SHA256
dc06db1dc05fad16aa820074f03db3cf2cea5f5b9e5ff9136f5cad896ccf0ab8
-
SHA512
61952fedcec08d8d940899381bef50a0e82cb86f226a4d207eccaa0958da6f71f517fb5ba2e704dfce320812bf1ba7e03fa934fb860cd57d69f43cc625195507
-
SSDEEP
768:zt5DuFP8FFIHGD+pqSh151a0SszvW4loC8DcztQcCZzt236dCuOMc:7DSPja+gS91aMzdxztQlZztPdCuRc
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Loader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Loader.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Loader.exe Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Loader.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Loader.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2324 taskmgr.exe Token: SeSystemProfilePrivilege 2324 taskmgr.exe Token: SeCreateGlobalPrivilege 2324 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe 2324 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1420 Loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1420
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2324
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3640