Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Perky And ...LC.exe
windows7-x64
1Perky And ...LC.exe
windows10-2004-x64
1Perky And ...on.exe
windows7-x64
3Perky And ...on.exe
windows10-2004-x64
3Perky And ....5.exe
windows7-x64
7Perky And ....5.exe
windows10-2004-x64
7$PLUGINSDI...md.dll
windows7-x64
3$PLUGINSDI...md.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Perky And ...es.cmd
windows7-x64
7Perky And ...es.cmd
windows10-2004-x64
7Perky And ...es.bat
windows7-x64
1Perky And ...es.bat
windows10-2004-x64
1Perky And ...rs.ps1
windows7-x64
3Perky And ...rs.ps1
windows10-2004-x64
3Perky And ...ws.ps1
windows7-x64
3Perky And ...ws.ps1
windows10-2004-x64
7Perky And ...ut.lnk
windows7-x64
3Perky And ...ut.lnk
windows10-2004-x64
3Perky And ...na.ps1
windows7-x64
3Perky And ...na.ps1
windows10-2004-x64
3Perky And ...ew.ps1
windows7-x64
3Perky And ...ew.ps1
windows10-2004-x64
3Perky And ...na.ps1
windows7-x64
3Perky And ...na.ps1
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/ISLC/Intelligent standby list cleaner ISLC.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/ISLC/Intelligent standby list cleaner ISLC.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/TimerResolution/TimerResolution.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/TimerResolution/TimerResolution.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/XMouseButtonControlSetup.2.20.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/XMouseButtonControlSetup.2.20.5.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Perky And Kanvs Optimization V1/Cleaner/Clean Log Files.cmd
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Perky And Kanvs Optimization V1/Cleaner/Clean Log Files.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Perky And Kanvs Optimization V1/Cleaner/Clean Temporary Files.bat
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Perky And Kanvs Optimization V1/Cleaner/Clean Temporary Files.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Clear Last Used Files and Folders.ps1
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Clear Last Used Files and Folders.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Debloat Windows.ps1
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Debloat Windows.ps1
Resource
win10v2004-20240910-en
Behavioral task
behavioral25
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Debloater - Shortcut.lnk
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Debloater - Shortcut.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Disable Cortana.ps1
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Disable Cortana.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Disable Last Used Files and Folders View.ps1
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Disable Last Used Files and Folders View.ps1
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Enable Cortana.ps1
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Perky And Kanvs Optimization V1/Debloater/Individual Scripts/Enable Cortana.ps1
Resource
win10v2004-20240802-en
General
-
Target
Perky And Kanvs Optimization V1/0 Mouse Delay + Input Delay/ISLC/Intelligent standby list cleaner ISLC.exe
-
Size
415KB
-
MD5
89d15c051c0599560c92b076aa274499
-
SHA1
3cb71afeb143a8fadbb2c9ff8546687b34ef2ea4
-
SHA256
065ebe279db9b8b2fef5e9bd9137b5daf278c5444426b602405793cecf1e0cb8
-
SHA512
d5870881cec900ddab83fd23624369e1a21be259486523a6f64050cfe9390035e453fce66e9043672b55641e5ca5b4909a72ae809b2333f8e97d049f0a73a3b3
-
SSDEEP
6144:47leVdRQ/vqkg1gEagdQH6VdRQ/vqkg1gEagdQHYVdRQ/vqkg1gEagd0iaqP:8eV7uikFg9V7uikFgVV7uikFgRP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Intelligent standby list cleaner ISLC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Intelligent standby list cleaner ISLC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Intelligent standby list cleaner ISLC.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe 1052 Intelligent standby list cleaner ISLC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1052 Intelligent standby list cleaner ISLC.exe Token: SeProfSingleProcessPrivilege 1052 Intelligent standby list cleaner ISLC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1052 Intelligent standby list cleaner ISLC.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1052 Intelligent standby list cleaner ISLC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Perky And Kanvs Optimization V1\0 Mouse Delay + Input Delay\ISLC\Intelligent standby list cleaner ISLC.exe"C:\Users\Admin\AppData\Local\Temp\Perky And Kanvs Optimization V1\0 Mouse Delay + Input Delay\ISLC\Intelligent standby list cleaner ISLC.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1052
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4700