Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
242fb5498503fdae24861ca26f762745.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
242fb5498503fdae24861ca26f762745.exe
Resource
win10v2004-20231215-en
General
-
Target
242fb5498503fdae24861ca26f762745.exe
-
Size
188KB
-
MD5
242fb5498503fdae24861ca26f762745
-
SHA1
e45e4180137ea7c9d81f127fac0af48cf3b4e8d7
-
SHA256
7984d85806d611e8d7e3ec5640186ebce9b1daccbd07a4bbda0fc6e0e5666299
-
SHA512
5717a9d38ff151384fe522b5b55f7a4882bcb897d65d1c9fbd0b155f05138cc698db39805d34150daf5260906d8e09d6d752190e7d681eb181eb3569378a48fd
-
SSDEEP
3072:F+ogFpSWSqqbZ0ZEuwGE5pwFGHiG1InFGHiPZEuwGE5p:F+7AtqqbZFfGE5pakipkiufGE5p
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe 242fb5498503fdae24861ca26f762745.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SPINTOS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\posekiggerne\\optrner.exe" ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5028 242fb5498503fdae24861ca26f762745.exe 1620 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5028 set thread context of 1620 5028 242fb5498503fdae24861ca26f762745.exe 96 -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5028 242fb5498503fdae24861ca26f762745.exe 5028 242fb5498503fdae24861ca26f762745.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5028 242fb5498503fdae24861ca26f762745.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5028 wrote to memory of 448 5028 242fb5498503fdae24861ca26f762745.exe 95 PID 5028 wrote to memory of 448 5028 242fb5498503fdae24861ca26f762745.exe 95 PID 5028 wrote to memory of 448 5028 242fb5498503fdae24861ca26f762745.exe 95 PID 5028 wrote to memory of 1620 5028 242fb5498503fdae24861ca26f762745.exe 96 PID 5028 wrote to memory of 1620 5028 242fb5498503fdae24861ca26f762745.exe 96 PID 5028 wrote to memory of 1620 5028 242fb5498503fdae24861ca26f762745.exe 96 PID 5028 wrote to memory of 1620 5028 242fb5498503fdae24861ca26f762745.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\242fb5498503fdae24861ca26f762745.exe"C:\Users\Admin\AppData\Local\Temp\242fb5498503fdae24861ca26f762745.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\242fb5498503fdae24861ca26f762745.exe"2⤵PID:448
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\242fb5498503fdae24861ca26f762745.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1620
-