Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
102d640e53d6...02.exe
windows10-1703-x64
102d640e53d6...02.exe
windows7-x64
102d640e53d6...02.exe
windows10-2004-x64
1095de56b7b2...57.exe
windows10-1703-x64
1095de56b7b2...57.exe
windows7-x64
1095de56b7b2...57.exe
windows10-2004-x64
10d950b50f5f...4e.exe
windows10-1703-x64
10d950b50f5f...4e.exe
windows7-x64
10d950b50f5f...4e.exe
windows10-2004-x64
10d62c1f65b0...b4.exe
windows10-1703-x64
10d62c1f65b0...b4.exe
windows7-x64
10d62c1f65b0...b4.exe
windows10-2004-x64
10Resubmissions
25/12/2022, 14:22
221225-rppf7abf39 1025/12/2022, 14:22
221225-rpkg8seg4s 1025/12/2022, 14:21
221225-rpexraeg31 1025/12/2022, 14:21
221225-rn92haeg3z 1025/12/2022, 14:13
221225-rjx65seg3w 10Analysis
-
max time kernel
79s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25/12/2022, 14:22
Behavioral task
behavioral1
Sample
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Resource
win7-20221111-en
Behavioral task
behavioral3
Sample
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
d950b50f5f6430bec1db8de9f36b9a4e.exe
Resource
win10-20220812-en
Behavioral task
behavioral8
Sample
d950b50f5f6430bec1db8de9f36b9a4e.exe
Resource
win7-20221111-en
Behavioral task
behavioral9
Sample
d950b50f5f6430bec1db8de9f36b9a4e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral10
Sample
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
Resource
win10-20220812-en
Behavioral task
behavioral11
Sample
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
Resource
win7-20221111-en
General
-
Target
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe
-
Size
9.1MB
-
MD5
58ec0acfe4edcc15917b97ef91596f07
-
SHA1
60e610685d9a549926e7a9b0cb6bcc6509708d3c
-
SHA256
2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02
-
SHA512
5769c348149efc107d94bd02e6bbb16440c7974533b843cc42fb7c23fb3e2209754ab69ca9f04a0ba4c56c83e5c30983568a1b1d5f9861c1328befdf09e78736
-
SSDEEP
196608:K2ejh9Qo2P3Cgnpmtw69DvGSfkDpVpyPc9izcM/WaQCf:Kd4CHx3IyP4izp+Uf
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe -
resource yara_rule behavioral1/memory/4328-160-0x0000000000010000-0x000000000092E000-memory.dmp themida behavioral1/memory/4328-161-0x0000000000010000-0x000000000092E000-memory.dmp themida behavioral1/memory/4328-224-0x0000000000010000-0x000000000092E000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4328 set thread context of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 -
Program crash 1 IoCs
pid pid_target Process procid_target 5100 4576 WerFault.exe 67 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67 PID 4328 wrote to memory of 4576 4328 2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"C:\Users\Admin\AppData\Local\Temp\2d640e53d6e6d96266afb87c150403609c66d66ab1a5404c20efb13c85f9ae02.exe"2⤵PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 4843⤵
- Program crash
PID:5100
-
-