Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 10:24

General

  • Target

    aa3d40c34d88ebc024f798e3e5a720e6cd7f6f447cdfbbead1f0c5bba72d4312.exe

  • Size

    5.4MB

  • MD5

    380b17feab2c2dc51b7940a95295678e

  • SHA1

    d39bb6eabdf04e535737f77ef838f5ad6bdb4b6a

  • SHA256

    aa3d40c34d88ebc024f798e3e5a720e6cd7f6f447cdfbbead1f0c5bba72d4312

  • SHA512

    728c01575152a1b8637bba1db1078e3c66e8631351c18ec55c4356e26af1fcd16b5d9698058e4247b7e43c5090f173b19d81664b1c60b03b6e98cb3f6a278c3e

  • SSDEEP

    98304:c6te5FnoajcsPJRRCsA7J//OaHvQyqW9oe4+JOijZdMAuaKzG3gu5:c75ZxPJRRy7h/8yh13jZSAuaqGwC

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 14 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa3d40c34d88ebc024f798e3e5a720e6cd7f6f447cdfbbead1f0c5bba72d4312.exe
    "C:\Users\Admin\AppData\Local\Temp\aa3d40c34d88ebc024f798e3e5a720e6cd7f6f447cdfbbead1f0c5bba72d4312.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2944
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:4712
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:1508

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\System32\GroupPolicy\gpt.ini

        Filesize

        127B

        MD5

        8ef9853d1881c5fe4d681bfb31282a01

        SHA1

        a05609065520e4b4e553784c566430ad9736f19f

        SHA256

        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

        SHA512

        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

      • memory/2944-10-0x00007FFE80030000-0x00007FFE80031000-memory.dmp

        Filesize

        4KB

      • memory/2944-16-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-7-0x00007FFE80000000-0x00007FFE80002000-memory.dmp

        Filesize

        8KB

      • memory/2944-9-0x00007FFED3190000-0x00007FFED3385000-memory.dmp

        Filesize

        2.0MB

      • memory/2944-0-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-8-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-11-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-12-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-13-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-17-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-6-0x00007FFED09C0000-0x00007FFED0C89000-memory.dmp

        Filesize

        2.8MB

      • memory/2944-15-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-14-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-18-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-1-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-26-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-27-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-38-0x00007FFED09C0000-0x00007FFED0C89000-memory.dmp

        Filesize

        2.8MB

      • memory/2944-39-0x00007FFED3190000-0x00007FFED3385000-memory.dmp

        Filesize

        2.0MB

      • memory/2944-40-0x00007FF79C090000-0x00007FF79CEA9000-memory.dmp

        Filesize

        14.1MB

      • memory/2944-41-0x00007FFED09C0000-0x00007FFED0C89000-memory.dmp

        Filesize

        2.8MB

      • memory/2944-42-0x00007FFED3190000-0x00007FFED3385000-memory.dmp

        Filesize

        2.0MB