Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/05/2023, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe
Resource
win7-20230220-en
General
-
Target
414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe
-
Size
3.2MB
-
MD5
31f8c08862caa2ec10a82867dbdf188b
-
SHA1
144d1037d253808aae23d2fa14d930a76bc7ad51
-
SHA256
414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf
-
SHA512
52288d822170c3d813258ed63d97975f5f3f6c0f0d3238fe54a38cfa80f8c675efec3d2ea3a23b15f6d37408f7419f5b17e28970116f919273451190f587083f
-
SSDEEP
49152:CC9i1Db4FFMmKLZi9gOzDx8iE66tfvbFDfgC0JaRYHw3pjLMRzJwWlo1a4/0fH:xwF4FjGOzF8iAtbFDV0JaRm9RzJGkJv
Malware Config
Extracted
laplas
http://45.159.189.33
-
api_key
d1a05de376c0be1daa56dfb2715c8a0c5df8a111b8b31decc886df1e48db7c9c
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ntlhost.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ntlhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe -
Executes dropped EXE 1 IoCs
pid Process 1256 ntlhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2000 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ntlhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2000 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe 1256 ntlhost.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1256 2000 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe 27 PID 2000 wrote to memory of 1256 2000 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe 27 PID 2000 wrote to memory of 1256 2000 414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe"C:\Users\Admin\AppData\Local\Temp\414a0bf51ee426a007c528ecb84a563f21c40f3a2feb06485baad0e8ab439adf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1256
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669.8MB
MD5a6fb7b23cf8da8fefb1f9b95171b742c
SHA1c645235f38791650df95183e031df0f7fa6c509e
SHA256d8b3a105f6c3870de43b7ec24b02ca2f550161ae1a183ae66ea52ebc229f04a4
SHA51292127cfa8c7d00688ae3b844c9964513eb4613f9bebe48de5b87a4994113f60eca8a63dfbf81b7c1024f0a133396108773eb0bdefdb83e02aa7a9c77e15ccda0
-
Filesize
668.0MB
MD50487ef4b0acc398901ca53b417fc4e7b
SHA155c024db081607210e4c131c90ef69d9fa0a362a
SHA256ba1b9265594f56b814b9542174427226c463f5e495bf9ca73ea68e0ac02b888e
SHA51264d46612186b197c4902e72c6e5b18c55d9b65f3aca88c06e4f378eb711bf8d65353ba02326a4d460e1b3f1fecd3d3f094724cabee969ac0a9f2caa77f059ed9