Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 18:03
Behavioral task
behavioral1
Sample
syslmgrsvc.exe
Resource
win7-20240729-en
windows7-x64
21 signatures
150 seconds
General
-
Target
syslmgrsvc.exe
-
Size
93KB
-
MD5
a318cc45e79498b93e40d5e5b9b76be4
-
SHA1
4ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5
-
SHA256
4b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2
-
SHA512
3131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c
-
SSDEEP
1536:zL0IGzbFmav82I3dTCPu0864k/+ELInCSA+HK:30poOPPuRxk/jr+HK
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" syslmgrsvc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslmgrsvc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslmgrsvc.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syslmgrsvc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4840 taskmgr.exe Token: SeSystemProfilePrivilege 4840 taskmgr.exe Token: SeCreateGlobalPrivilege 4840 taskmgr.exe Token: 33 4840 taskmgr.exe Token: SeIncBasePriorityPrivilege 4840 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe 4840 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\syslmgrsvc.exe"C:\Users\Admin\AppData\Local\Temp\syslmgrsvc.exe"1⤵
- Modifies security service
- Windows security bypass
- Windows security modification
- System Location Discovery: System Language Discovery
PID:4200
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4840