Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 19:53
Behavioral task
behavioral1
Sample
NEAS.4974df26a9e6b84577a351703ae429a0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.4974df26a9e6b84577a351703ae429a0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.4974df26a9e6b84577a351703ae429a0.exe
-
Size
2.5MB
-
MD5
4974df26a9e6b84577a351703ae429a0
-
SHA1
148ad51f9779e67c210a8090f9ea6002366bd9fe
-
SHA256
2d0e4d3a259a50ed3f7d1ea67be6ddf426f5b7dcacd5f494d00b78321c40d4e4
-
SHA512
5e80e158af8850e575f9ca077f4538478fce0a8d1c5d746fb4e58d5ce37fecd6d79f0c97c83812c2b9ee763ac7c69291bf6c349104cb678d8b605bb6aa57d1b2
-
SSDEEP
49152:y4daOqAehx7x20RKuniOJqfU7F1tLYoNovTE3pzNx0FOnpe4v/68M:cP7tRtrJq88SqgnpXiH
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ NEAS.4974df26a9e6b84577a351703ae429a0.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axfniqh.exe -
Modifies AppInit DLL entries 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion NEAS.4974df26a9e6b84577a351703ae429a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion NEAS.4974df26a9e6b84577a351703ae429a0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axfniqh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axfniqh.exe -
Executes dropped EXE 1 IoCs
pid Process 2260 axfniqh.exe -
resource yara_rule behavioral2/memory/5108-0-0x0000000000400000-0x0000000000A57000-memory.dmp themida behavioral2/memory/5108-1-0x0000000000400000-0x0000000000A57000-memory.dmp themida behavioral2/memory/5108-2-0x0000000000400000-0x0000000000A57000-memory.dmp themida behavioral2/files/0x000b000000022ccb-9.dat themida behavioral2/files/0x000b000000022ccb-10.dat themida behavioral2/memory/2260-11-0x0000000000400000-0x0000000000A57000-memory.dmp themida behavioral2/memory/2260-12-0x0000000000400000-0x0000000000A57000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NEAS.4974df26a9e6b84577a351703ae429a0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA axfniqh.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\axfniqh.exe NEAS.4974df26a9e6b84577a351703ae429a0.exe File created C:\PROGRA~3\Mozilla\bqqaoam.dll axfniqh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4974df26a9e6b84577a351703ae429a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4974df26a9e6b84577a351703ae429a0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5108
-
C:\PROGRA~3\Mozilla\axfniqh.exeC:\PROGRA~3\Mozilla\axfniqh.exe -pdtylqd1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5ead2f2f96bb20311aa644cb96cef85f7
SHA18e61fb402c6730b93b860c12aee171df470f9d42
SHA256f04b9e158a3203f57cf20761d289c285815d63fbf303382bc0a88e3a060c0f0a
SHA512876e0be828fae988253b08b19a5a540153c9c9444867fdb5e3dafa7d0e37ac650515396a08229f036cd196cc542cf75aeefda2a18575d6a9c2f61154334d7162
-
Filesize
2.5MB
MD5ead2f2f96bb20311aa644cb96cef85f7
SHA18e61fb402c6730b93b860c12aee171df470f9d42
SHA256f04b9e158a3203f57cf20761d289c285815d63fbf303382bc0a88e3a060c0f0a
SHA512876e0be828fae988253b08b19a5a540153c9c9444867fdb5e3dafa7d0e37ac650515396a08229f036cd196cc542cf75aeefda2a18575d6a9c2f61154334d7162