Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 03:43

General

  • Target

    rm2.vmp.exe

  • Size

    11.4MB

  • MD5

    9a722b5590def62024a8b857709b784b

  • SHA1

    a31b8e1fd4da40b98c16d3012df463e8488347e2

  • SHA256

    85fdd8dac21e71ad98916d2941637c882e1f39cd5255c72a9fe9436aec7f650c

  • SHA512

    0607723c183271fcbd8dc636c080bc5c5ade147afe4a91c129516db07278b07475595a5ee1ad1ecb4ecfa04127418fec93e44b86ab35217a02acd9580205903c

  • SSDEEP

    196608:aU9rGneSo1G/SkVqdqgJ/JIGHsjpsXuoN2miWqoYxq/NQFO5Is7RkH4:F5tSoJh/JIGusXuoN2miWYq/2wzR

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rm2.vmp.exe
    "C:\Users\Admin\AppData\Local\Temp\rm2.vmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:2720
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/264-15-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-19-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-14-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-16-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-7-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-9-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-17-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-8-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-18-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/264-13-0x000001D51FDC0000-0x000001D51FDC1000-memory.dmp

      Filesize

      4KB

    • memory/3936-1-0x00007FFC0BC70000-0x00007FFC0BC72000-memory.dmp

      Filesize

      8KB

    • memory/3936-0-0x00007FF668147000-0x00007FF668803000-memory.dmp

      Filesize

      6.7MB

    • memory/3936-6-0x00007FF668110000-0x00007FF669372000-memory.dmp

      Filesize

      18.4MB

    • memory/3936-3-0x00007FF668110000-0x00007FF669372000-memory.dmp

      Filesize

      18.4MB

    • memory/3936-20-0x00007FF668147000-0x00007FF668803000-memory.dmp

      Filesize

      6.7MB

    • memory/3936-21-0x00007FF668110000-0x00007FF669372000-memory.dmp

      Filesize

      18.4MB