Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_911e66524f9a5cd74310756c975ce7cf.exe
Resource
win7-20231215-en
General
-
Target
VirusShare_911e66524f9a5cd74310756c975ce7cf.exe
-
Size
163KB
-
MD5
911e66524f9a5cd74310756c975ce7cf
-
SHA1
560e3441ba41ba22652d8200ce57f17a9e1ec5c4
-
SHA256
9460876404af1e8aed0eaec4cb29b37631db3c9038d5dd2e6e2fdb3e60a8d0e9
-
SHA512
a92aff4f1095b67610f854e3f8be6fe11679ae0e38a8c0008d2fe493a05f1a613efb418bd8c42e36faf9498d8ecd15dc2f8424790ad5407c44fc184c996efbb8
-
SSDEEP
3072:KswLeUpdrYpctTXSERLK3pgotbLmMGWGLxsYrVd3ZephYrWttlUDzP:zwLjdMCtfRu5/tbLQrXpahHtjk
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List surv86.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Debug\surv86.exe = "C:\\Windows\\Debug\\surv86.exe:*:Enabled:KL" surv86.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List VirusShare_911e66524f9a5cd74310756c975ce7cf.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile VirusShare_911e66524f9a5cd74310756c975ce7cf.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications VirusShare_911e66524f9a5cd74310756c975ce7cf.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe:*:Enabled:KL" VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Detects Windows executables referencing non-Windows User-Agents 12 IoCs
resource yara_rule behavioral2/memory/1216-4-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-2-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-6-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-9-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-11-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-41-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-40-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-50-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1216-46-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1900-59-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1900-62-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/1900-63-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 12 IoCs
resource yara_rule behavioral2/memory/1216-4-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-2-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-6-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-9-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-11-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-41-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-40-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-50-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1216-46-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1900-59-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1900-62-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1900-63-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Executes dropped EXE 2 IoCs
pid Process 2260 surv86.exe 1900 surv86.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4892 set thread context of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 2260 set thread context of 1900 2260 surv86.exe 98 -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Debug\bc VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File opened for modification C:\Windows\Debug\bc VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File created C:\Windows\Debug\surv86.exe VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File opened for modification C:\Windows\Debug\surv86.exe VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File created C:\Windows\Debug\result.dark VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File opened for modification C:\Windows\Debug\result.dark VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File created C:\Windows\Debug\bc surv86.exe File opened for modification C:\Windows\Debug\bc surv86.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 916 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 4892 wrote to memory of 1216 4892 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 91 PID 1216 wrote to memory of 916 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 93 PID 1216 wrote to memory of 916 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 93 PID 1216 wrote to memory of 916 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 93 PID 1216 wrote to memory of 2260 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 96 PID 1216 wrote to memory of 2260 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 96 PID 1216 wrote to memory of 2260 1216 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 96 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98 PID 2260 wrote to memory of 1900 2260 surv86.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exeC:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe2⤵
- Modifies firewall policy service
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\sc.exesc delete 1323733⤵
- Launches sc.exe
PID:916
-
-
C:\Windows\Debug\surv86.exe"C:\Windows\Debug\surv86.exe" /start3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\Debug\surv86.exeC:\Windows\Debug\surv86.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in Windows directory
PID:1900
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD5911e66524f9a5cd74310756c975ce7cf
SHA1560e3441ba41ba22652d8200ce57f17a9e1ec5c4
SHA2569460876404af1e8aed0eaec4cb29b37631db3c9038d5dd2e6e2fdb3e60a8d0e9
SHA512a92aff4f1095b67610f854e3f8be6fe11679ae0e38a8c0008d2fe493a05f1a613efb418bd8c42e36faf9498d8ecd15dc2f8424790ad5407c44fc184c996efbb8