Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 16:35
Behavioral task
behavioral1
Sample
Gold_Loader_Fix_for_Failed_to_Manual_Map.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
Gold_Loader_Fix_for_Failed_to_Manual_Map.exe
-
Size
3.7MB
-
MD5
f7ad66c788ad7eb004ff3dfdcdf85117
-
SHA1
4a5fdba606dab4cf8cb1cdfdf7626b1080216571
-
SHA256
1a1261caef18506b52eda231a348e23ee09d15650d37224ce7f89925bdde30c5
-
SHA512
0d3384fdef1caa6bd3c88f8b3de90ecc27218d3f7d9e46684642a08cf6f002bb39431d11472af981dd0b9012c8646948413c281c7c1b4a08aa6e9f2f68139a7b
-
SSDEEP
98304:X/nDzvmtmetiTn+WM0JHGP1Ltj0mnE/p:X/DziiTnBG9xwyYp
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Gold_Loader_Fix_for_Failed_to_Manual_Map.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Gold_Loader_Fix_for_Failed_to_Manual_Map.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Gold_Loader_Fix_for_Failed_to_Manual_Map.exe -
resource yara_rule behavioral2/memory/4304-0-0x0000000140000000-0x00000001409DE000-memory.dmp themida behavioral2/memory/4304-2-0x0000000140000000-0x00000001409DE000-memory.dmp themida behavioral2/memory/4304-3-0x0000000140000000-0x00000001409DE000-memory.dmp themida behavioral2/memory/4304-4-0x0000000140000000-0x00000001409DE000-memory.dmp themida behavioral2/memory/4304-5-0x0000000140000000-0x00000001409DE000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Gold_Loader_Fix_for_Failed_to_Manual_Map.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4304 Gold_Loader_Fix_for_Failed_to_Manual_Map.exe 4304 Gold_Loader_Fix_for_Failed_to_Manual_Map.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4304 wrote to memory of 3564 4304 Gold_Loader_Fix_for_Failed_to_Manual_Map.exe 88 PID 4304 wrote to memory of 3564 4304 Gold_Loader_Fix_for_Failed_to_Manual_Map.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gold_Loader_Fix_for_Failed_to_Manual_Map.exe"C:\Users\Admin\AppData\Local\Temp\Gold_Loader_Fix_for_Failed_to_Manual_Map.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%2⤵PID:3564
-