Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
10/09/2022, 18:29
General
-
Target
2e801601f6fbfc97bb5a991bd4a4b92ea591eabe70d7d86a6eac26549fcfab5d.exe
-
Size
365KB
-
MD5
6e9fdb1ac3859e908475bc69b239435a
-
SHA1
251dcbd7385c20b02a7a9dfce1270b834c5d4659
-
SHA256
2e801601f6fbfc97bb5a991bd4a4b92ea591eabe70d7d86a6eac26549fcfab5d
-
SHA512
2c5b2ee91a4347f477c7ff802b1b562f548a8bc45c08fde06ec359c221f07f921291e46bf639377ef5cf20f7581e1d40b0e008c26ea89812f05ea73565093bc5
-
SSDEEP
6144:ecTKOC7+0H3uMAKbUQ8qfH4umdyJRVP+C5XYo9zZ1FKGUOUTE6qJWoDU0v+Dudrr:eWqH3D3bUQ8qfH4byJRV2CNYYBKGUOWC
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Themida packer 15 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e801601f6fbfc97bb5a991bd4a4b92ea591eabe70d7d86a6eac26549fcfab5d.exe"C:\Users\Admin\AppData\Local\Temp\2e801601f6fbfc97bb5a991bd4a4b92ea591eabe70d7d86a6eac26549fcfab5d.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exe.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeC:\Users\Admin\AppData\Local\cache\MoUSO.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD52cd5c6a845991271ef4add6854e3e891
SHA18a94eda717ab810d252e952c58430b8470d4bed7
SHA25610598b84211275b9113400387a8370bd1d7d79acf828927e12871831c433d20c
SHA512a65fdfbfb692b996f159720deb628f8e9f7d2cc4113c84b6a9243e62aac1a8c7a4c6c77fa672facedb68a7163b2dc6eed751219fe8957cd20fc09df468d9772c
-
Filesize
2.9MB
MD52cd5c6a845991271ef4add6854e3e891
SHA18a94eda717ab810d252e952c58430b8470d4bed7
SHA25610598b84211275b9113400387a8370bd1d7d79acf828927e12871831c433d20c
SHA512a65fdfbfb692b996f159720deb628f8e9f7d2cc4113c84b6a9243e62aac1a8c7a4c6c77fa672facedb68a7163b2dc6eed751219fe8957cd20fc09df468d9772c
-
Filesize
2.9MB
MD52cd5c6a845991271ef4add6854e3e891
SHA18a94eda717ab810d252e952c58430b8470d4bed7
SHA25610598b84211275b9113400387a8370bd1d7d79acf828927e12871831c433d20c
SHA512a65fdfbfb692b996f159720deb628f8e9f7d2cc4113c84b6a9243e62aac1a8c7a4c6c77fa672facedb68a7163b2dc6eed751219fe8957cd20fc09df468d9772c
-
Filesize
2.9MB
MD52cd5c6a845991271ef4add6854e3e891
SHA18a94eda717ab810d252e952c58430b8470d4bed7
SHA25610598b84211275b9113400387a8370bd1d7d79acf828927e12871831c433d20c
SHA512a65fdfbfb692b996f159720deb628f8e9f7d2cc4113c84b6a9243e62aac1a8c7a4c6c77fa672facedb68a7163b2dc6eed751219fe8957cd20fc09df468d9772c
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
1.6MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
1.6MB