Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 02:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BD_XBKZMF293NV1.0.0B02.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
1800 seconds
General
-
Target
BD_XBKZMF293NV1.0.0B02.exe
-
Size
35.7MB
-
MD5
d0a9da5a6cd3942d65c12da8b8fc775a
-
SHA1
d07383642a5c42370e9212a235902949256f9d03
-
SHA256
084fda5b3151b52ef20ea95fc45d0d699ee10df0d9db8dbbcc3ca9934f2bf18c
-
SHA512
162e2d1f97c1fbd591e0acfcd6d3afddff94ff376b81308cd966bd89c2d5d325e026fe5643f277926f7c9ccd6d208078657a26e3a112dfddfbd23a5a70b081cc
-
SSDEEP
786432:k5ASihNhS4QrpeDnYMq+7pQH0N46sQxi6GIuCLskSh1sQ7:mdcSjpeDnC0vMiQ9d
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 652 BD_XBKZMF293NV1.0.0B02.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD_XBKZMF293NV1.0.0B02.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 652 BD_XBKZMF293NV1.0.0B02.exe 652 BD_XBKZMF293NV1.0.0B02.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 212 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 212 taskmgr.exe Token: SeSystemProfilePrivilege 212 taskmgr.exe Token: SeCreateGlobalPrivilege 212 taskmgr.exe Token: 33 212 taskmgr.exe Token: SeIncBasePriorityPrivilege 212 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 652 BD_XBKZMF293NV1.0.0B02.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BD_XBKZMF293NV1.0.0B02.exe"C:\Users\Admin\AppData\Local\Temp\BD_XBKZMF293NV1.0.0B02.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:652
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1676
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:212