Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Themida.exe
windows10-2004-x64
10Themida64.exe
windows10-2004-x64
10ThemidaHelp.chm
windows10-2004-x64
1ThemidaSDK...in.xml
windows10-2004-x64
1ThemidaSDK...in.dll
windows10-2004-x64
3ThemidaSDK...t1.xml
windows10-2004-x64
1ThemidaSDK...ct1.js
windows10-2004-x64
1ThemidaSDK...e.html
windows10-2004-x64
1ThemidaSDK...le.xml
windows10-2004-x64
1ThemidaSDK...10.xml
windows10-2004-x64
1ThemidaSDK...llo.js
windows10-2004-x64
1ThemidaSDK...t1.xml
windows10-2004-x64
1ThemidaSDK...ct1.js
windows10-2004-x64
1ThemidaSDK...le.xml
windows10-2004-x64
1ThemidaSDK...llo.js
windows10-2004-x64
1ThemidaSDK...pt.exe
windows10-2004-x64
1ThemidaSDK...on.pdf
windows10-2004-x64
1ThemidaSDK...32.dll
windows10-2004-x64
1ThemidaSDK...64.dll
windows10-2004-x64
1WinlicenseSDK.dll
windows10-2004-x64
3demangler.dll
windows10-2004-x64
3libspv.dll
windows10-2004-x64
1vcomp140.dll
windows10-2004-x64
3Analysis
-
max time kernel
61s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2023, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
Themida.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Themida64.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
ThemidaHelp.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/TestPlugin.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
ThemidaSDK/ExamplesSDK/Plugins/Examples/Delphi/TestPlugin.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/CBuilder/Project1.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.vcproj.7.10.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/Rust/hello.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
ThemidaSDK/ExamplesSDK/Protection Macros/C/CBuilder/Project1.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
ThemidaSDK/ExamplesSDK/Protection Macros/C/Visual C++(via ASM module)/vc_example.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
ThemidaSDK/ExamplesSDK/Protection Macros/Rust/hello.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
ThemidaSDK/ExamplesSDK/Protection Macros/Visual Basic/Vb6NoOpt.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
ThemidaSDK/Include/C/Via ASM module/How to add ASM files in your Solution.pdf
Resource
win10v2004-20230221-en
Behavioral task
behavioral18
Sample
ThemidaSDK/SecureEngineSDK32.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
ThemidaSDK/SecureEngineSDK64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
WinlicenseSDK.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
demangler.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
libspv.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
vcomp140.dll
Resource
win10v2004-20230220-en
General
-
Target
ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.xml
-
Size
11KB
-
MD5
429e2cb8cf9f7de1b2002ae00cefcf36
-
SHA1
05c0f85bd470c3a985eeb070b73fd0d336f9bc0f
-
SHA256
0a0196a87764dca2d6649f7e979a60b3192bd8fdde5b917f994472df6dc6621b
-
SHA512
4061718b73fd03b15b93b15d9f84971f11e81ad4c02aa73e3835aa08938b2b5ca5a8df72fafd97cf8a160387bac7e30b1f1f0859dcfad682a6da3ac68971f0db
-
SSDEEP
192:Q7kEqgkPp4T6U53CEqpCQ7EqCkPp4T6U53CEqbfQjwZibRZnpwwi6Rwnl:jDvqCrCQ7ZvqC5fQjwZibRZnpwwi6Rwl
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A3279DB2-FAD4-11ED-9EF6-5E272E2E2FB8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31035105" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4781d8231f5c142a4a5a03b4162f936000000000200000000001066000000010000200000001decae81cfc4398099a8f10dc9e5a48820e656991a4bf962bd188a62ebdaedcc000000000e80000000020000200000006111d74bdfa1fd2525412266faf062c8a98f05f3d9015ce5340e31bee55981d5200000003d3442d387dcfa6217f1642ca5cf85058cf91c4aa8b4ed1d99fc50e54af8c4c44000000053612d73776155e9bba651021257c553be0d1d3c10021ce20890c0cc51664cfb626bf6a883c12d82f4e7b2bf428b6e3a85c74cae58dc73c7f5412dc837e6eaa8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035105" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2029908499" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0007de79e18ed901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2029908499" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4781d8231f5c142a4a5a03b4162f936000000000200000000001066000000010000200000009919ce7b7d2345bcd4c9f358af41ae254b8e8c347fa587ed2597f31333f66816000000000e800000000200002000000064a6d43f4744a3160444dbfc86b0fdf0f298edf1ed5e865ec25628ae72e0c9f3200000007fc38ff5d1bb12669cf7cff2a08ef021a02109848f06e16ed6dfcb252ee1b5ca40000000b881844dc2a12384e16edfb664bcd2fe4c375d58bafa3bac22345265a0a694f0b6ae61b2576f2fe564c9df5ea3c33ebca44d4e7c15c25650ed312f0442cce51d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c045f879e18ed901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2788 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2788 iexplore.exe 2788 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2788 2096 MSOXMLED.EXE 83 PID 2096 wrote to memory of 2788 2096 MSOXMLED.EXE 83 PID 2788 wrote to memory of 3016 2788 iexplore.exe 85 PID 2788 wrote to memory of 3016 2788 iexplore.exe 85 PID 2788 wrote to memory of 3016 2788 iexplore.exe 85
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\ExamplesSDK\Protectio Macros(Check Protection)\C\Visual C++\vc_example.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\ExamplesSDK\Protectio Macros(Check Protection)\C\Visual C++\vc_example.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d