Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
612s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 08:27 UTC
General
-
Target
lasservices_spoofer.exe
-
Size
11.0MB
-
MD5
09bbb184c9a6e587b0f40492723e604f
-
SHA1
4bbcfa112b1cf36b138d463a7e6a99fbe94754eb
-
SHA256
6235dcfcc025b267404345ac9cbab036edd2e17b7f1c3009374042204d380b21
-
SHA512
906402ea905c08ce33690ce6d8b04e20ba50537ccd66e5422a27b1899960d2501ac693d5d06045bb68fd755f5c454ea8d319042f5383cc579e113c541e405317
-
SSDEEP
196608:JGluENPKd3fjqfnHzW2JmMf8PzHm1ufh6Bffpf5YUAyQ:Ml5RKJqPaMQa1ufh6BZyUAN
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 51 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe"C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe" MD53⤵
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe"C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\lasservices_spoofer.exe" MD53⤵
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
Network
-
DNS134.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse -
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNSkeyauth.winRemote address:8.8.8.8:53Requestkeyauth.winIN AResponsekeyauth.winIN A104.26.0.5keyauth.winIN A104.26.1.5keyauth.winIN A172.67.72.57
-
POSThttps://keyauth.win/api/1.2/Remote address:104.26.0.5:443RequestPOST /api/1.2/ HTTP/1.1
Host: keyauth.win
Accept: */*
Content-Length: 108
Content-Type: application/x-www-form-urlencoded
ResponseHTTP/1.1 200 OK
Date: Sat, 24 Feb 2024 08:28:11 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 411
Connection: keep-alive
signature: 9899830c0c4b7158235c69f85a43e9efa8b6d73219ceed7d33a0de82588991ac
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kh3907%2B7JJxq61fCzyQu0eGd4POL1RG0aObuaAYLKWkp29SzjxdpB0tgXopgRlPrAYTCd5mwLdVn7i68IbZO8Ka4Zb3I2%2BPragfkPEBeVuHJq1g2%2FFQAlsi7rbXr"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Acknowledge: Credit to VaultCord.com
X-Powered-By: VaultCord.com
content-security-policy: upgrade-insecure-requests
permissions-policy: accelerometer=(), camera=(), fullscreen=*, geolocation=(self), gyroscope=(), microphone=(), payment=*
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-security-policy: img-src *; media-src * data:;
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: *
Access-Control-Allow-Origin: *
Server: cloudflare
CF-RAY: 85a65569e8d56325-LHR
-
DNSx2.c.lencr.orgRemote address:8.8.8.8:53Requestx2.c.lencr.orgIN AResponsex2.c.lencr.orgIN CNAMEcrl.root-x1.letsencrypt.org.edgekey.netcrl.root-x1.letsencrypt.org.edgekey.netIN CNAMEe8652.dscx.akamaiedge.nete8652.dscx.akamaiedge.netIN A2.19.169.32
-
GEThttp://x2.c.lencr.org/Remote address:2.19.169.32:80RequestGET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org
ResponseHTTP/1.1 200 OK
Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Mon, 12 Feb 2024 22:07:27 GMT
ETag: "65ca969f-12b"
Cache-Control: max-age=3600
Expires: Sat, 24 Feb 2024 09:28:11 GMT
Date: Sat, 24 Feb 2024 08:28:11 GMT
Content-Length: 299
Connection: keep-alive
-
DNS5.0.26.104.in-addr.arpaRemote address:8.8.8.8:53Request5.0.26.104.in-addr.arpaIN PTRResponse
-
DNS32.169.19.2.in-addr.arpaRemote address:8.8.8.8:53Request32.169.19.2.in-addr.arpaIN PTRResponse32.169.19.2.in-addr.arpaIN PTRa2-19-169-32deploystaticakamaitechnologiescom
-
POSThttps://keyauth.win/api/1.2/Remote address:104.26.0.5:443RequestPOST /api/1.2/ HTTP/1.1
Host: keyauth.win
Accept: */*
Content-Length: 123
Content-Type: application/x-www-form-urlencoded
ResponseHTTP/1.1 200 OK
Date: Sat, 24 Feb 2024 08:28:12 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 344
Connection: keep-alive
signature: 379dec924c1f715b76775d5429bad50ef5cee6dc0373a4d402af23b7184c5d6b
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUe1bbyaZ71WP1IQqkpErFAt0QtN4iHo8jO%2BYHDWA6%2FU8sFYE7fXivEqR2uTx5WGcb2dspDLvthWuuZV9wRMqSWfJbZ%2FHtk1fgKr1SLdcD4IzteqxplGUsoXcH6D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Acknowledge: Credit to VaultCord.com
X-Powered-By: VaultCord.com
content-security-policy: upgrade-insecure-requests
permissions-policy: accelerometer=(), camera=(), fullscreen=*, geolocation=(self), gyroscope=(), microphone=(), payment=*
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-security-policy: img-src *; media-src * data:;
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: *
Access-Control-Allow-Origin: *
Server: cloudflare
CF-RAY: 85a6556d1b0d6536-LHR
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS217.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
DNS209.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request209.178.17.96.in-addr.arpaIN PTRResponse209.178.17.96.in-addr.arpaIN PTRa96-17-178-209deploystaticakamaitechnologiescom
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
DNScxcs.microsoft.netRemote address:8.8.8.8:53Requestcxcs.microsoft.netIN AResponsecxcs.microsoft.netIN CNAMEcxcs.microsoft.net.edgekey.netcxcs.microsoft.net.edgekey.netIN CNAMEe3230.b.akamaiedge.nete3230.b.akamaiedge.netIN A23.214.133.66
-
138.91.171.81:80
-
127.0.0.1:52785 -
127.0.0.1:52787
-
104.26.0.5:443https://keyauth.win/api/1.2/tls, http
HTTP Request
POST https://keyauth.win/api/1.2/HTTP Response
200 -
2.19.169.32:80http://x2.c.lencr.org/http
HTTP Request
GET http://x2.c.lencr.org/HTTP Response
200 -
104.26.0.5:443https://keyauth.win/api/1.2/tls, http
HTTP Request
POST https://keyauth.win/api/1.2/HTTP Response
200 -
127.0.0.1:52792
-
127.0.0.1:52794
-
104.26.0.5:443keyauth.wintls
-
8.8.8.8:53134.32.126.40.in-addr.arpadns
DNS Request
134.32.126.40.in-addr.arpa
-
8.8.8.8:5343.58.199.20.in-addr.arpadns
DNS Request
43.58.199.20.in-addr.arpa
-
8.8.8.8:53keyauth.windns
DNS Request
keyauth.win
DNS Response
104.26.0.5104.26.1.5172.67.72.57
-
8.8.8.8:53x2.c.lencr.orgdns
DNS Request
x2.c.lencr.org
DNS Response
2.19.169.32
-
8.8.8.8:535.0.26.104.in-addr.arpadns
DNS Request
5.0.26.104.in-addr.arpa
-
8.8.8.8:5332.169.19.2.in-addr.arpadns
DNS Request
32.169.19.2.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53217.135.221.88.in-addr.arpadns
DNS Request
217.135.221.88.in-addr.arpa
-
8.8.8.8:53209.178.17.96.in-addr.arpadns
DNS Request
209.178.17.96.in-addr.arpa
-
8.8.8.8:5319.229.111.52.in-addr.arpadns
DNS Request
19.229.111.52.in-addr.arpa
-
8.8.8.8:5379.121.231.20.in-addr.arpadns
DNS Request
79.121.231.20.in-addr.arpa
-
8.8.8.8:53cxcs.microsoft.netdns
DNS Request
cxcs.microsoft.net
DNS Response
23.214.133.66
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
27.6MB
-
Filesize
760KB
-
Filesize
27.6MB
-
Filesize
64KB
-
Filesize
27.6MB
-
Filesize
2.8MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
2.8MB
-
Filesize
760KB
-
Filesize
27.6MB
-
Filesize
8KB
-
Filesize
27.6MB
-
Filesize
2.0MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
2.8MB
-
Filesize
27.6MB
-
Filesize
2.8MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB
-
Filesize
27.6MB