Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/08/2024, 14:08
240808-rfx2zayake 408/08/2024, 14:06
240808-reqw9svaqj 308/08/2024, 14:03
240808-rc4eksxhpc 4Analysis
-
max time kernel
37s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
08/08/2024, 14:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Void server boost/void server boost.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
General
-
Target
Void server boost/void server boost.exe
-
Size
1.0MB
-
MD5
ce1c66fbc99abd29ad81c5d064e0f966
-
SHA1
72394086d1916da3697e8513672e09f59a1ff907
-
SHA256
a18628e8080b21bf266abf4f571063abba2207ac2d999993541a0f49176b4801
-
SHA512
fca61fcb62742b33b46f7d6e73bcb6f0d841f7b96845e0578a36541945e7ada2eeefc812d698093935aa0809518178f764e0d04bcf889031abea4fd1f0f9621a
-
SSDEEP
24576:njih34xvK2EW2rLZHSIa6agTRpnnJMOr2I7cimoi1Cu:nO34xyD9L9LagThXr2+Vm
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 604 taskmgr.exe Token: SeSystemProfilePrivilege 604 taskmgr.exe Token: SeCreateGlobalPrivilege 604 taskmgr.exe Token: 33 604 taskmgr.exe Token: SeIncBasePriorityPrivilege 604 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵PID:3428
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:604
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵PID:3832