Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18/05/2023, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
unaugmentative.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
unaugmentative.exe
Resource
win10v2004-20230220-en
General
-
Target
unaugmentative.exe
-
Size
684KB
-
MD5
f4f8aa33be37944caa797974dd05ef42
-
SHA1
560f24bc30646f11814617bcdbbe40bf208a674a
-
SHA256
a12c0cba66449b46e1186671fab58ba802ebf1ba938619e1239d74b733c79afe
-
SHA512
ed365eeb0f978e7cb8fc1ea0c12faaf3ff913214bc896df99bfcf9ab03a74b319e64bc0c1b33f7752d1d8659e57f566c18c22d839edbe72a6bd75f80f9626d83
-
SSDEEP
12288:phrO+j2I2llYaIwGPZiy6RRXju3SP3d9mSSF6UWQE/onCO6P:ptxj2IMCZZ633PKWQE/V
Malware Config
Signatures
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe unaugmentative.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe unaugmentative.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\International\Geo\Nation unaugmentative.exe -
Loads dropped DLL 1 IoCs
pid Process 1596 unaugmentative.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1404 unaugmentative.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1596 unaugmentative.exe 1404 unaugmentative.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1596 set thread context of 1404 1596 unaugmentative.exe 28 PID 1404 set thread context of 1596 1404 unaugmentative.exe 27 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\underdrying.lnk unaugmentative.exe File opened for modification C:\Windows\Fonts\underdrying.lnk unaugmentative.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1404 unaugmentative.exe 1404 unaugmentative.exe 1404 unaugmentative.exe 1404 unaugmentative.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1596 unaugmentative.exe 1404 unaugmentative.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1404 unaugmentative.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1404 1596 unaugmentative.exe 28 PID 1596 wrote to memory of 1404 1596 unaugmentative.exe 28 PID 1596 wrote to memory of 1404 1596 unaugmentative.exe 28 PID 1596 wrote to memory of 1404 1596 unaugmentative.exe 28 PID 1596 wrote to memory of 1404 1596 unaugmentative.exe 28 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31 PID 1596 wrote to memory of 1328 1596 unaugmentative.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\unaugmentative.exe"C:\Users\Admin\AppData\Local\Temp\unaugmentative.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\unaugmentative.exe"C:\Users\Admin\AppData\Local\Temp\unaugmentative.exe"2⤵
- Checks QEMU agent file
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵PID:1328
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
978B
MD54045f712f6b60422e85bbf3db2dcd5ba
SHA12bdbc1368b03cd556e278ac076949b85c9f0e226
SHA25618b47e63947d95c68acdc6258024aaf85b5cfb09f4969a572fe5e1e9b78a5651
SHA512bfdab8d6875b272e3ab2a74177ec360884bd2d5abb1add2cd7a9ff527bbd42df739d274fc701fa2b8e5cdf6a69ae584e5e0dc529f1dd085c99a3b07de94b372e
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9