Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
290s -
max time network
294s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/10/2022, 03:49
Behavioral task
behavioral1
Sample
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe
Resource
win7-20220812-en
General
-
Target
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe
-
Size
8.2MB
-
MD5
23150d8faa66ce23299e2c032b8fd62f
-
SHA1
26c7c604d01f784931a3a95f1efeb56bfe1aec69
-
SHA256
bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b
-
SHA512
17ae25cce526a5eb11202cc779f5d62fc45b14a4d547e2eb88694dc21c83fdb853731adfd7cb47fb3499f140ddedf61175415504a0c93cb2ed3b3f25e989f5e7
-
SSDEEP
196608:JzxikPsLoM1ZPdUYcoV1alsmMzU5tReoS+P6n:JzIkP7M1ZP64alnB5t5SF
Malware Config
Extracted
systembc
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Executes dropped EXE 1 IoCs
pid Process 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion migeyih quipaha xajiced banokora ririb bevirov kimatis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Deletes itself 1 IoCs
pid Process 1984 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe -
resource yara_rule behavioral1/memory/2036-55-0x0000000000A30000-0x0000000001271000-memory.dmp themida behavioral1/memory/2036-56-0x0000000000A30000-0x0000000001271000-memory.dmp themida behavioral1/files/0x000b00000001230f-64.dat themida behavioral1/files/0x000b00000001230f-66.dat themida behavioral1/memory/552-69-0x0000000000F70000-0x00000000017B1000-memory.dmp themida behavioral1/memory/552-70-0x0000000000F70000-0x00000000017B1000-memory.dmp themida behavioral1/memory/2036-72-0x0000000000A30000-0x0000000001271000-memory.dmp themida behavioral1/memory/552-76-0x0000000000F70000-0x00000000017B1000-memory.dmp themida behavioral1/memory/552-87-0x0000000000F70000-0x00000000017B1000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 552 set thread context of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 784 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1496 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 26 PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 26 PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 26 PID 2036 wrote to memory of 784 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 26 PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 28 PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 28 PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 28 PID 2036 wrote to memory of 552 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 28 PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 29 PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 29 PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 29 PID 2036 wrote to memory of 1984 2036 bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe 29 PID 1984 wrote to memory of 1352 1984 cmd.exe 31 PID 1984 wrote to memory of 1352 1984 cmd.exe 31 PID 1984 wrote to memory of 1352 1984 cmd.exe 31 PID 1984 wrote to memory of 1352 1984 cmd.exe 31 PID 1984 wrote to memory of 1496 1984 cmd.exe 32 PID 1984 wrote to memory of 1496 1984 cmd.exe 32 PID 1984 wrote to memory of 1496 1984 cmd.exe 32 PID 1984 wrote to memory of 1496 1984 cmd.exe 32 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1380 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 33 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34 PID 552 wrote to memory of 1128 552 migeyih quipaha xajiced banokora ririb bevirov kimatis.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"2⤵
- Creates scheduled task(s)
PID:784
-
-
C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:1380
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:1128
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\bbd8b41c49eaee839da5fc62c999761efb835e7eb84f73cbf531cf0dd40c608b.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:1352
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1496
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe
Filesize795.2MB
MD55447fa8fde4c52c62d163be3e9d9ada1
SHA16bf49b6a6118133d384aa99dde2a2330f5198e26
SHA25632650671503ab30ea8060338b09fe48662ab2a808fe0e97ae5093a5713a92ad7
SHA5120cbacfc88e13a567d885421e2113279ac67ec115ee077e50b45c25d61a29c3a4f6bb304698f9269e021e2c011b10beb4953b8efb982bc6929963c6be172175da
-
\Users\Admin\Dage qui podeta xesaxapo copib pab tiqu fixolol pok xowa niweke\migeyih quipaha xajiced banokora ririb bevirov kimatis.exe
Filesize795.2MB
MD55447fa8fde4c52c62d163be3e9d9ada1
SHA16bf49b6a6118133d384aa99dde2a2330f5198e26
SHA25632650671503ab30ea8060338b09fe48662ab2a808fe0e97ae5093a5713a92ad7
SHA5120cbacfc88e13a567d885421e2113279ac67ec115ee077e50b45c25d61a29c3a4f6bb304698f9269e021e2c011b10beb4953b8efb982bc6929963c6be172175da