Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 17:47

General

  • Target

    RUT_V3.exe

  • Size

    10.3MB

  • MD5

    a961d772dd3cf64aac768de86e0c346b

  • SHA1

    5b842b850cf20c6589ff0a468be93ffb0deeb5a0

  • SHA256

    3a39454c9059db4f64e6ddb92a89383f8429fb832a9118ce0d1e9cd93a87a517

  • SHA512

    77da1ab2e393a68d0063b601c70c941ba30ee54f58cf435a30e277d16067921e4faad46326823606444751bfd8cea7bd2c5d078d7e313d1a0850ba5cb76cc15f

  • SSDEEP

    196608:XwhlrIeTPA0+jmdGoxGNTF4bIl8DN6skBGtshCD7rupK4wfvK0:XI96DOGWAmb+8DVEh22pK1B

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RUT_V3.exe
    "C:\Users\Admin\AppData\Local\Temp\RUT_V3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe"
      2⤵
        PID:2376
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\SysWOW64\cmd.exe"
        2⤵
          PID:2612

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4520-0-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-1-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-2-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-3-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-4-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-5-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-6-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-7-0x0000024A6B150000-0x0000024A6B151000-memory.dmp

        Filesize

        4KB

      • memory/4520-21-0x00007FF642220000-0x00007FF643CC5000-memory.dmp

        Filesize

        26.6MB

      • memory/4520-208-0x0000024A6B150000-0x0000024A6B151000-memory.dmp

        Filesize

        4KB

      • memory/4520-209-0x0000024A6CCB0000-0x0000024A6CD27000-memory.dmp

        Filesize

        476KB

      • memory/4520-210-0x0000024A6D650000-0x0000024A6D6C7000-memory.dmp

        Filesize

        476KB