Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/02/2024, 23:00
General
-
Target
ad1427f6cca3d14f405f847fdb508efa.exe
-
Size
2.6MB
-
MD5
ad1427f6cca3d14f405f847fdb508efa
-
SHA1
c131531758503e531edfc322048269291d7719c0
-
SHA256
a628618f961434862d7ae607e762b29d299ad695648caac0b7c37278b623e373
-
SHA512
905581251e9ddfb451d09a9c07b6e8e5ce73563ca9eb16422d43991613546cb619791c22a18c147af7680a237c0ebeac59427c53dd57b83cf4a9e4cdeb1e2c33
-
SSDEEP
49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gf:tKq4oEa9RQs+Cn4/UKf
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1427f6cca3d14f405f847fdb508efa.exe"C:\Users\Admin\AppData\Local\Temp\ad1427f6cca3d14f405f847fdb508efa.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5265c290fd251b305c954d2b4dc22527a
SHA10b5ed1307d7a8d3168f7f56dd7ee6d144f5caac0
SHA256494e603d3c4ea0d0e575607955916d052d586f7edc8e5bc82eb06def4555bfc3
SHA5124f1b4eb0f5a47fbd0266a4bfd7514deef9e915e8767410087c8999d78ba1ddb860a7177f8bf6dc33864bb0c2f194b156ef4246bac3cfae53596b7829e122e24c
-
Filesize
187KB
MD5583682648beb3b694447b796b52b9a50
SHA1efa8ec5572affcf59d64845b2a3c138763a969f2
SHA256da80c019a571381a8cc33d7e4153f3e081957559cb9938e2f2bf2c246a7ede09
SHA512322ff43024da7059f8caefe89ee92b5e1a1e43de9dab12a084ce77e6ebd103f5948791669b7a4ba4240c9c7bd0c62442f91b9e93b07e29c711c9ea62495c319a
-
Filesize
2.6MB
MD577292be41b9e129702e16b465d1995d2
SHA144e7e337f6b3ae4236856ae1ac43852823bd8440
SHA2564211aec9f7ea008bf15bca77a38ceaa7e10803254a981719d4183dc8af4ec388
SHA512a0ea3561919d0d90634595b4954f843a0afe6bd85ce7c74abdb50cbd9cad780e6cff006ebe7d771196524ffc20cd353e477d1831059d0b13fff85fc0ed609c85
-
Filesize
2.6MB
MD5cd1423925abf2b17291e8230b661daeb
SHA1c9432530296d1dea0ba62dd2f67b0caac4546f1a
SHA256d965d168d249b45beececcaa07ca4e766596b51e70e9d922a884b1d635f2e78f
SHA512f1e92c2cde110a4a7e073322a5d893474ec0da622dace985a43930884cef487b8cdc37eec91de4e622ac8c2c976a2e942ff2777a060fe25e06454c2151447e87
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB