Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 02:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
202407名单.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
202407名单.exe
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
202407名单.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral4
Sample
GBgvQcZI.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral5
Sample
GBgvQcZI.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
GBgvQcZI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
300 seconds
General
-
Target
202407名单.exe
-
Size
11.1MB
-
MD5
4981608f030982bea9c2c6defab80a5d
-
SHA1
b15cf8423eb62e29812a81066adecfe31e5be743
-
SHA256
8dc8867273f93678845ec8dfdfd84af24ab606121c3c076a0f6c5228e5cea862
-
SHA512
fffab8d7a2cd3f3f99db5b5093ad80dbc6013aabe7a8be488c8e3bccf01562b48cb760d29066790e8b577f21cbc033a0602936b92c758d154cc5b9a11abf2d65
-
SSDEEP
6144:uBGnXixYRgmR8Ltknr2iW18eHxaVjSB1zVJJSB:8GnXixpo8xjaVjSB1zVJJw
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 3508 202407名单.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1656 taskmgr.exe Token: SeSystemProfilePrivilege 1656 taskmgr.exe Token: SeCreateGlobalPrivilege 1656 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe 1656 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\202407名单.exe"C:\Users\Admin\AppData\Local\Temp\202407名单.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1656