Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
98s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
10/01/2025, 12:24
Behavioral task
behavioral1
Sample
e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
8 signatures
300 seconds
General
-
Target
e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293.exe
-
Size
7.0MB
-
MD5
8f2b7a45a93ee6f4806918aaa99c1b1b
-
SHA1
3a71e11a742a1ba1b7c088ce1377bd9eeb0f63f0
-
SHA256
e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293
-
SHA512
d436d66d97e689b9a05d8b4af1b75fc79ae8ba9880b6f3b9b731c5228f11ad77f621b6b802e29c9aec071f7a486989ea1c45349957b73d52ec1c0ddd6f7312d1
-
SSDEEP
98304:bAQQU9TWEdwOY7jhM28X5dq8Lk1BssJJmk3om1hV:bAQQU4Mw37jhUX5KAsJJmcoYL
Score
10/10
Malware Config
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Blackcat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4980 taskmgr.exe Token: SeSystemProfilePrivilege 4980 taskmgr.exe Token: SeCreateGlobalPrivilege 4980 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe 4980 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293.exe"C:\Users\Admin\AppData\Local\Temp\e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4004,i,4931345718161570516,7922954771140051020,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵PID:1572
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4980