Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
38s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
31/12/2024, 20:20
Behavioral task
behavioral1
Sample
Bootstraper.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
6 signatures
900 seconds
General
-
Target
Bootstraper.exe
-
Size
72.1MB
-
MD5
2ac637855651012ed522385e1099753d
-
SHA1
1f4e9db25fd9a95b6bd92c58518e8da242691316
-
SHA256
f00acb22d462f26c98c9390a795848dfd3dd49f2d8e7699dfaa2dbec7506969f
-
SHA512
c29e54c73f5ff2fc69bce3a81df68ddb43bf5909aa2378804f51fc61021829af46f457d21eaccdfa48893235288403b23f9028d8ceac8613b9131654de95f1f9
-
SSDEEP
393216:warluWuIO7+48bIvGIkGncM9XRTGw6tADv8i1L4GPTsmUzqOL3EfDa32H628Xb:Y796Kku3Z6eDv8SP4EfDa32a2S
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4352 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4352 taskmgr.exe Token: SeSystemProfilePrivilege 4352 taskmgr.exe Token: SeCreateGlobalPrivilege 4352 taskmgr.exe Token: 33 4352 taskmgr.exe Token: SeIncBasePriorityPrivilege 4352 taskmgr.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe 4352 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe"1⤵PID:2204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4648,i,14915941200180617206,472089282896125147,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:81⤵PID:1960
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4352