Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe
-
Size
897KB
-
MD5
8c0de0256142e6c494b02630cdf0b667
-
SHA1
91c6377097f4681d7b1f1a5dfce1a95865f30324
-
SHA256
744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb
-
SHA512
781cda77d387c5c55291d55a8ae9e49560d4ec0006e3c02b7e4fdb9ca674e2546be395256afef76dd603457a18dd741afbc83045ecabd2a181a9720394f23646
-
SSDEEP
24576:o5f0X77Gu9o9UpgWoaYQ/ObNshEOQJ+riG:u1u9fvPYSGN6ErJq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ apocalyps32.exe -
Executes dropped EXE 1 IoCs
pid Process 1736 apocalyps32.exe -
resource yara_rule behavioral1/memory/1736-66-0x0000000040010000-0x000000004004C000-memory.dmp upx -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Wine apocalyps32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2036 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 1736 apocalyps32.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe File opened for modification C:\Windows\apocalyps32.exe 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2036 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 1736 apocalyps32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1736 2036 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 26 PID 2036 wrote to memory of 1736 2036 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 26 PID 2036 wrote to memory of 1736 2036 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 26 PID 2036 wrote to memory of 1736 2036 744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe 26 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27 PID 1736 wrote to memory of 1616 1736 apocalyps32.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe"C:\Users\Admin\AppData\Local\Temp\744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\apocalyps32.exe-bs2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1616
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
897KB
MD58c0de0256142e6c494b02630cdf0b667
SHA191c6377097f4681d7b1f1a5dfce1a95865f30324
SHA256744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb
SHA512781cda77d387c5c55291d55a8ae9e49560d4ec0006e3c02b7e4fdb9ca674e2546be395256afef76dd603457a18dd741afbc83045ecabd2a181a9720394f23646
-
Filesize
897KB
MD58c0de0256142e6c494b02630cdf0b667
SHA191c6377097f4681d7b1f1a5dfce1a95865f30324
SHA256744de75df602abe008bda830f8343b9af530ee62763d7525ac86403038d5b1eb
SHA512781cda77d387c5c55291d55a8ae9e49560d4ec0006e3c02b7e4fdb9ca674e2546be395256afef76dd603457a18dd741afbc83045ecabd2a181a9720394f23646