Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    292s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 04:45

General

  • Target

    AppGate2103v01.exe

  • Size

    4.3MB

  • MD5

    858bb0a3b4fa6a54586402e3ee117076

  • SHA1

    997c31f043347883ea5ed2323a558b6cc5ea9c8e

  • SHA256

    d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35

  • SHA512

    e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

  • SSDEEP

    98304:n64KjpOZP7Gf8oC4felvJoch5wET9ItRmeFa6vcuEDAm:nBKlSPaMlxocM8+tE6kuEMm

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AppGate2103v01.exe
    "C:\Users\Admin\AppData\Local\Temp\AppGate2103v01.exe"
    1⤵
    • Modifies firewall policy service
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2372
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:4204
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:3720

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\System32\GroupPolicy\gpt.ini

        Filesize

        127B

        MD5

        8ef9853d1881c5fe4d681bfb31282a01

        SHA1

        a05609065520e4b4e553784c566430ad9736f19f

        SHA256

        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

        SHA512

        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

      • memory/2372-9-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-11-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-3-0x00007FFFBD270000-0x00007FFFBD539000-memory.dmp

        Filesize

        2.8MB

      • memory/2372-4-0x00007FFF80030000-0x00007FFF80031000-memory.dmp

        Filesize

        4KB

      • memory/2372-6-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-7-0x00007FFF80000000-0x00007FFF80002000-memory.dmp

        Filesize

        8KB

      • memory/2372-5-0x00007FFFBEF70000-0x00007FFFBF02E000-memory.dmp

        Filesize

        760KB

      • memory/2372-0-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-2-0x00007FFFBD270000-0x00007FFFBD539000-memory.dmp

        Filesize

        2.8MB

      • memory/2372-8-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-10-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-12-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-13-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-14-0x00007FFFBFAF0000-0x00007FFFBFCE5000-memory.dmp

        Filesize

        2.0MB

      • memory/2372-1-0x00007FFFBD270000-0x00007FFFBD539000-memory.dmp

        Filesize

        2.8MB

      • memory/2372-22-0x00007FF706A00000-0x00007FF70750A000-memory.dmp

        Filesize

        11.0MB

      • memory/2372-23-0x00007FFFBD270000-0x00007FFFBD539000-memory.dmp

        Filesize

        2.8MB

      • memory/2372-25-0x00007FFFBFAF0000-0x00007FFFBFCE5000-memory.dmp

        Filesize

        2.0MB