Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 01:12
Behavioral task
behavioral1
Sample
sohomsloader.exe
Resource
win7-20230831-en
9 signatures
150 seconds
General
-
Target
sohomsloader.exe
-
Size
3.7MB
-
MD5
f43385b098b7602cf0e714186453bc56
-
SHA1
30870c1bac7baac18fbbbba59972a489f7340e6c
-
SHA256
e80c6585c56434eb0b2085157e4493e1f027fb5d8e3683abfd205d053e38b19f
-
SHA512
bb80df89695850a957ecc134530e263b874f599234cba720a7b0f852f1a86d4f6b0260fe44f4f015ce476cdce3c3d454e21fcc0e3493fb72273cfea692c1c556
-
SSDEEP
98304:mMqryQv3Zac93fFEpe6kgOg4F9vS0P7m4oRWjT:m9Hs4QPkgOgUZ7m4oRWP
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ sohomsloader.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions sohomsloader.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion sohomsloader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion sohomsloader.exe -
resource yara_rule behavioral1/memory/2596-0-0x000000013F950000-0x000000014033E000-memory.dmp themida behavioral1/memory/2596-2-0x000000013F950000-0x000000014033E000-memory.dmp themida behavioral1/memory/2596-3-0x000000013F950000-0x000000014033E000-memory.dmp themida behavioral1/memory/2596-4-0x000000013F950000-0x000000014033E000-memory.dmp themida behavioral1/memory/2596-5-0x000000013F950000-0x000000014033E000-memory.dmp themida behavioral1/memory/2596-6-0x000000013F950000-0x000000014033E000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sohomsloader.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN sohomsloader.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe 2596 sohomsloader.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1940 2596 sohomsloader.exe 29 PID 2596 wrote to memory of 1940 2596 sohomsloader.exe 29 PID 2596 wrote to memory of 1940 2596 sohomsloader.exe 29 PID 1940 wrote to memory of 2300 1940 cmd.exe 30 PID 1940 wrote to memory of 2300 1940 cmd.exe 30 PID 1940 wrote to memory of 2300 1940 cmd.exe 30 PID 1940 wrote to memory of 2056 1940 cmd.exe 32 PID 1940 wrote to memory of 2056 1940 cmd.exe 32 PID 1940 wrote to memory of 2056 1940 cmd.exe 32 PID 1940 wrote to memory of 2696 1940 cmd.exe 31 PID 1940 wrote to memory of 2696 1940 cmd.exe 31 PID 1940 wrote to memory of 2696 1940 cmd.exe 31 PID 2596 wrote to memory of 2744 2596 sohomsloader.exe 33 PID 2596 wrote to memory of 2744 2596 sohomsloader.exe 33 PID 2596 wrote to memory of 2744 2596 sohomsloader.exe 33 PID 2596 wrote to memory of 2712 2596 sohomsloader.exe 34 PID 2596 wrote to memory of 2712 2596 sohomsloader.exe 34 PID 2596 wrote to memory of 2712 2596 sohomsloader.exe 34 PID 2596 wrote to memory of 2952 2596 sohomsloader.exe 35 PID 2596 wrote to memory of 2952 2596 sohomsloader.exe 35 PID 2596 wrote to memory of 2952 2596 sohomsloader.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe"C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe" MD53⤵PID:2300
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2696
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2744
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2596 -s 23962⤵PID:2712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2952
-