Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 23:19

General

  • Target

    DS4Windows/DS4Windows.exe

  • Size

    546KB

  • MD5

    e196e463c0e550d0f49748008fbb27b9

  • SHA1

    221960368ae1e190f90cf0b7d51199c3d94a6558

  • SHA256

    ccacb1f4c5b2f24c5a61bf09c10bfe44fb9d46af8b993c1f5bf01dc1b3733a65

  • SHA512

    dfa3f83930a6eec958cc69b8978a009dda6a9050b026cf399c5e1cd07f787c515ed497202c7341878032ac89b2f57d8d219bcf824dc622dcd40fa2f530b49cae

  • SSDEEP

    6144:jDewyY9egLRePYm58DKYPbz0YM+SS5hjS8kfdjS0gNsNHZBuh:j6wZePMJzm1S3O8iNS0YQHbe

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DS4Windows\DS4Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\DS4Windows\DS4Windows.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2168
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1900
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Modifies registry class
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Videos\Captures\desktop.ini

    Filesize

    190B

    MD5

    b0d27eaec71f1cd73b015f5ceeb15f9d

    SHA1

    62264f8b5c2f5034a1e4143df6e8c787165fbc2f

    SHA256

    86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

    SHA512

    7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c