Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
test.exe
-
Size
2.7MB
-
MD5
df7e347342e7b3c21a395b8a50ff4b4d
-
SHA1
d82b30b0917bd84b31d9ba3598a4a61332a0570d
-
SHA256
1bc77bb85046bc29c5e72b97f0d604c5566c6f8db754dc9f92767506403644d1
-
SHA512
4e7d8bb5ec9349081ea057b92a538668d3cf1746ea434bb8df44b560c74ce5236189dee2aa2d597f8522da71b4211280cb328a1e1b321b9cb13218f9d9c92363
-
SSDEEP
24576:GpSyFci43L0B+K1hr5EJa4esU5FsDxdz8FQG+Ec0xMki8UsU3AoQ0qDt5KBMJ:GpSyFci4b0B+K1hlEbT8S80qDt5KBMJ
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2192 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4720 WMIC.exe Token: SeSecurityPrivilege 4720 WMIC.exe Token: SeTakeOwnershipPrivilege 4720 WMIC.exe Token: SeLoadDriverPrivilege 4720 WMIC.exe Token: SeSystemProfilePrivilege 4720 WMIC.exe Token: SeSystemtimePrivilege 4720 WMIC.exe Token: SeProfSingleProcessPrivilege 4720 WMIC.exe Token: SeIncBasePriorityPrivilege 4720 WMIC.exe Token: SeCreatePagefilePrivilege 4720 WMIC.exe Token: SeBackupPrivilege 4720 WMIC.exe Token: SeRestorePrivilege 4720 WMIC.exe Token: SeShutdownPrivilege 4720 WMIC.exe Token: SeDebugPrivilege 4720 WMIC.exe Token: SeSystemEnvironmentPrivilege 4720 WMIC.exe Token: SeRemoteShutdownPrivilege 4720 WMIC.exe Token: SeUndockPrivilege 4720 WMIC.exe Token: SeManageVolumePrivilege 4720 WMIC.exe Token: 33 4720 WMIC.exe Token: 34 4720 WMIC.exe Token: 35 4720 WMIC.exe Token: 36 4720 WMIC.exe Token: SeIncreaseQuotaPrivilege 4720 WMIC.exe Token: SeSecurityPrivilege 4720 WMIC.exe Token: SeTakeOwnershipPrivilege 4720 WMIC.exe Token: SeLoadDriverPrivilege 4720 WMIC.exe Token: SeSystemProfilePrivilege 4720 WMIC.exe Token: SeSystemtimePrivilege 4720 WMIC.exe Token: SeProfSingleProcessPrivilege 4720 WMIC.exe Token: SeIncBasePriorityPrivilege 4720 WMIC.exe Token: SeCreatePagefilePrivilege 4720 WMIC.exe Token: SeBackupPrivilege 4720 WMIC.exe Token: SeRestorePrivilege 4720 WMIC.exe Token: SeShutdownPrivilege 4720 WMIC.exe Token: SeDebugPrivilege 4720 WMIC.exe Token: SeSystemEnvironmentPrivilege 4720 WMIC.exe Token: SeRemoteShutdownPrivilege 4720 WMIC.exe Token: SeUndockPrivilege 4720 WMIC.exe Token: SeManageVolumePrivilege 4720 WMIC.exe Token: 33 4720 WMIC.exe Token: 34 4720 WMIC.exe Token: 35 4720 WMIC.exe Token: 36 4720 WMIC.exe Token: SeDebugPrivilege 2192 taskmgr.exe Token: SeSystemProfilePrivilege 2192 taskmgr.exe Token: SeCreateGlobalPrivilege 2192 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1260 1056 test.exe 84 PID 1056 wrote to memory of 1260 1056 test.exe 84 PID 1260 wrote to memory of 4720 1260 cmd.exe 85 PID 1260 wrote to memory of 4720 1260 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_videocontroller get videoprocessor2⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get videoprocessor3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192