Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3print.exe
windows10-2004-x64
1printfilte...vc.exe
windows10-2004-x64
1printui.exe
windows10-2004-x64
1proquota.exe
windows10-2004-x64
1provlaunch.exe
windows10-2004-x64
1provtool.exe
windows10-2004-x64
1prproc.exe
windows10-2004-x64
1psr.exe
windows10-2004-x64
1pwlauncher.exe
windows10-2004-x64
1rasautou.exe
windows10-2004-x64
1rasdial.exe
windows10-2004-x64
1raserver.exe
windows10-2004-x64
1rasphone.exe
windows10-2004-x64
1rdpclip.exe
windows10-2004-x64
1rdpinput.exe
windows10-2004-x64
1rdrleakdiag.exe
windows10-2004-x64
1readCloudD...gs.exe
windows10-2004-x64
1recdisc.exe
windows10-2004-x64
1recover.exe
windows10-2004-x64
1refsutil.exe
windows10-2004-x64
1reg.exe
windows10-2004-x64
1regedt32.exe
windows10-2004-x64
7regini.exe
windows10-2004-x64
1regsvr32.exe
windows10-2004-x64
1rekeywiz.exe
windows10-2004-x64
1relog.exe
windows10-2004-x64
1repair-bde.exe
windows10-2004-x64
1replace.exe
windows10-2004-x64
1resmon.exe
windows10-2004-x64
7rmttpmvscmgrsvr.exe
windows10-2004-x64
1rrinstaller.exe
windows10-2004-x64
1rstrui.exe
windows10-2004-x64
1Resubmissions
09/07/2024, 13:39
240709-qydwdayanf 709/07/2024, 07:52
240709-jqdr3swdle 609/07/2024, 06:42
240709-hgkzcs1bjl 509/07/2024, 06:34
240709-hb2d6azhjn 309/07/2024, 05:47
240709-ggxgqa1crh 4Analysis
-
max time kernel
87s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
print.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral2
Sample
printfilterpipelinesvc.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
printui.exe
Resource
win10v2004-20240708-en
Behavioral task
behavioral4
Sample
proquota.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
provlaunch.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral6
Sample
provtool.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
prproc.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral8
Sample
psr.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
pwlauncher.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral10
Sample
rasautou.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
rasdial.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral12
Sample
raserver.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
rasphone.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral14
Sample
rdpclip.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
rdpinput.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral16
Sample
rdrleakdiag.exe
Resource
win10v2004-20240708-en
Behavioral task
behavioral17
Sample
readCloudDataSettings.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral18
Sample
recdisc.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
recover.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral20
Sample
refsutil.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
reg.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral22
Sample
regedt32.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
regini.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral24
Sample
regsvr32.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
rekeywiz.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
relog.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
repair-bde.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral28
Sample
replace.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
resmon.exe
Resource
win10v2004-20240708-en
Behavioral task
behavioral30
Sample
rmttpmvscmgrsvr.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
rrinstaller.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral32
Sample
rstrui.exe
Resource
win10v2004-20240704-en
General
-
Target
pwlauncher.exe
-
Size
52KB
-
MD5
d0743203ba4eb04ddffdae63c8d6ded7
-
SHA1
117d5503b2bccf3c00623f5a6fd73213b871ad0e
-
SHA256
4e8dbb3e89dfd69856c0cce34a6f5960aab1e8d0b42c9dc991accb249e8ec044
-
SHA512
2bcf60617c5538b466b7263d8a175b9d5747c10126d1c62794b1330a4664885a28a0a1746da5ef26d0727b32bbb8b7b9d2515683e1efad036a1659b4eddb86d6
-
SSDEEP
768:JRLAuL35vJLgZmdagPZxMGE/GIfUMF0T8QSoe4KG0srxOC2fc+:JRjL35xUcTxgnPF0T8G0srY5fc+
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-587429654-1855694383-2268796072-1000\{251D105C-39BE-4104-8934-CAAB08123806} svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4152 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pwlauncher.exe"C:\Users\Admin\AppData\Local\Temp\pwlauncher.exe"1⤵PID:1636
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:3508
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:344