Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
17/04/2023, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe
Resource
win10-20230220-en
General
-
Target
6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe
-
Size
2.9MB
-
MD5
85150fc161f06e745f463388cd0fff4f
-
SHA1
38528c83c1fca3bdd07d6ed03a95deaab5e2b453
-
SHA256
6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6
-
SHA512
e505eaad59721c5f0ecce973b1a54394c164d47318ce6c6dad444f72696d8c50eb96b824377ec8ecb3c49f2e87541b70bc337e0e3bc38f03dce7c7342cf9acfe
-
SSDEEP
49152:iTuQ/+UDDq542HWdVlV7t2ftBl2fULWXBnWXg/wOy6vb3dvwM3Qh5h:iTu4+U/2QlVmtBaJw6z3Nwj
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ntlhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4128 ntlhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntlhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2932 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe 4128 ntlhost.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2932 wrote to memory of 4128 2932 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe 66 PID 2932 wrote to memory of 4128 2932 6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe"C:\Users\Admin\AppData\Local\Temp\6e49adb9932cd17f4b40af488ebf866d6de827dd7746ed1c47ed761c7f2ce4b6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4128
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
731.9MB
MD5d5191e726c818edeff655ccf78838241
SHA1aae6043bf700b927821b28140eb36678c464d3f7
SHA256d03f7d0014123df0b3ed36fd37d1aaf7f89b86db7b18de2c88651ef6509cde00
SHA512ee8b046b3a76594aee11bc50394aa308054fd09c0a3beff981108edc96f34282633760a4ded0f5893e45dcd943054bed846b521aa2c95dad463e1ecb30de2243
-
Filesize
731.9MB
MD5d5191e726c818edeff655ccf78838241
SHA1aae6043bf700b927821b28140eb36678c464d3f7
SHA256d03f7d0014123df0b3ed36fd37d1aaf7f89b86db7b18de2c88651ef6509cde00
SHA512ee8b046b3a76594aee11bc50394aa308054fd09c0a3beff981108edc96f34282633760a4ded0f5893e45dcd943054bed846b521aa2c95dad463e1ecb30de2243