Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/08/2024, 00:49
240817-a6d84s1arp 317/08/2024, 00:45
240817-a4km4sxcnc 417/08/2024, 00:41
240817-a19g3axblb 316/08/2024, 15:13
240816-slrb2s1fra 3Analysis
-
max time kernel
278s -
max time network
276s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/08/2024, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
Resource
win11-20240802-en
windows11-21h2-x64
9 signatures
600 seconds
General
-
Target
b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
-
Size
410KB
-
MD5
18152e40100de9cafb257df76f17e51e
-
SHA1
a310b69302d0945e5b4dcc02692c646a045bbf06
-
SHA256
b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931
-
SHA512
be22cdb522df9fe45cbb14db384fcfebfdcd520622455958f6b49f613186c440eb184c6bb2128976377aff02833df153df48f6c8d180ea3bda9bd3047165b0e1
-
SSDEEP
12288:hHsEjxLDavg3JmwxY1kzE+QIrZoftjNB:lsA+vSoqYAQmZoftn
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3820 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3820 taskmgr.exe Token: SeSystemProfilePrivilege 3820 taskmgr.exe Token: SeCreateGlobalPrivilege 3820 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe 3820 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2008 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4464
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3820
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2060
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"1⤵PID:4528
-
C:\Windows\System32\RuntimeBroker.exe"C:\Windows\System32\RuntimeBroker.exe"1⤵PID:2416
-
C:\Windows\System32\e4ozbkotpwqgu.exe"C:\Windows\System32\e4ozbkotpwqgu.exe"1⤵PID:948
-
C:\Windows\System32\yqj9q3.exe"C:\Windows\System32\yqj9q3.exe"1⤵PID:2244
-
C:\Windows\System32\yqj9q3.exe"C:\Windows\System32\yqj9q3.exe"1⤵PID:916
-
C:\Windows\System32\yqj9q3.exe"C:\Windows\System32\yqj9q3.exe"1⤵PID:1740
-
C:\Windows\System32\yqj9q3.exe"C:\Windows\System32\yqj9q3.exe"1⤵PID:1464
-
C:\Windows\System32\e4ozbkotpwqgu.exe"C:\Windows\System32\e4ozbkotpwqgu.exe"1⤵PID:4824
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5a7f391566ceb7d310b04c1376aa66a07
SHA1eda88e9134d3de209152481c9e8aa02054d4c2eb
SHA2568ecb81fa22792fa6bb09abc86b9b5afb50773e2c5537def45dd8ba297f6c714e
SHA512163bad20eaa9108286367367e6a54a9ac612026954ee2466b8f88f732a992695fe160d3fb5f092976ef15c1c1b71400e577a9a4833dfa616d7c9ee6a8237033c
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD57fc1af6f45e844eedd1a78d89ba2813d
SHA1bdd93c47e99e7da95f5888d01cb85550f8fae9ab
SHA25687577decf9290f786d76c3e9885e490106a7b00dd8a9b43471ff32f9eddd612e
SHA512e79bc304620d23981c9bc03ada331755eaf74f356f32461bced715ef6e5c3ceab947a5a1dc51ef9061427b5c9132f58b1c14cce33960dd469c066ec4458abe86