Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
34s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/09/2024, 08:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
out.exe
Resource
win11-20240802-en
windows11-21h2-x64
6 signatures
1800 seconds
General
-
Target
out.exe
-
Size
16.9MB
-
MD5
235edc61d61a829211f69a9b1ebbefef
-
SHA1
26a514d764ff20423dee2908c939df3449dc211b
-
SHA256
01568de8658e767ee3669e2f5550bec292f1251ca82d20f550c7cf971b483f7a
-
SHA512
3d9ad8366924e29d1aa05c4bf4ce7d28b3cd750425972279c4c6fd1d643c20b50ad95e1d484d1f05466d1c80cb792b46504f9a74e10680e3498b251927a20190
-
SSDEEP
393216:U8Hx7YprcracUfd80cxD1eTMV6MByDR5rUmlrVeE7gqfXiddT7zK/CEf:2XmK/b
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language out.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2092 Taskmgr.exe Token: SeSystemProfilePrivilege 2092 Taskmgr.exe Token: SeCreateGlobalPrivilege 2092 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe 2092 Taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3172
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092