Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

sohomsloader.exe

windows7-x64

9

sohomsloader.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 01:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sohomsloader.exe

  • Size

    3.7MB

  • MD5

    f43385b098b7602cf0e714186453bc56

  • SHA1

    30870c1bac7baac18fbbbba59972a489f7340e6c

  • SHA256

    e80c6585c56434eb0b2085157e4493e1f027fb5d8e3683abfd205d053e38b19f

  • SHA512

    bb80df89695850a957ecc134530e263b874f599234cba720a7b0f852f1a86d4f6b0260fe44f4f015ce476cdce3c3d454e21fcc0e3493fb72273cfea692c1c556

  • SSDEEP

    98304:mMqryQv3Zac93fFEpe6kgOg4F9vS0P7m4oRWjT:m9Hs4QPkgOgUZ7m4oRWP

Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe
    "C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\sohomsloader.exe" MD5
        3⤵
          PID:2300
        • C:\Windows\system32\find.exe
          find /i /v "certutil"
          3⤵
            PID:2696
          • C:\Windows\system32\find.exe
            find /i /v "md5"
            3⤵
              PID:2056
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            2⤵
              PID:2744
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2596 -s 2396
              2⤵
                PID:2712
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                2⤵
                  PID:2952

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2596-0-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-1-0x0000000076F20000-0x00000000770C9000-memory.dmp

                Filesize

                1.7MB

                Download

              • memory/2596-2-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-3-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-4-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-5-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-6-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-7-0x0000000001B30000-0x0000000001B31000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2596-15-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-16-0x0000000076F20000-0x00000000770C9000-memory.dmp

                Filesize

                1.7MB

                Download

              • memory/2596-17-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-18-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-19-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-20-0x000000013F950000-0x000000014033E000-memory.dmp

                Filesize

                9.9MB

                Download

              • memory/2596-21-0x0000000076F20000-0x00000000770C9000-memory.dmp

                Filesize

                1.7MB

                Download