Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
290s -
max time network
257s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25/04/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe
Resource
win7-20240221-en
General
-
Target
54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe
-
Size
8.3MB
-
MD5
64b25f16d49a37f436c63e1775b198da
-
SHA1
804da5dffaf421cb29adc2db00a0b4320b043aba
-
SHA256
54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d
-
SHA512
e23b748fdfe9398829f49fddb920c736afc6f97091a676a0e10a4f5f87c55e9c758459390157d16a765967103e734be0341482b449d378b34cdeb28bff394a19
-
SSDEEP
196608:S3N/DIuePUUHrzIlczP7BnjKqgQctFUn3Bf+IL0WmF1Vt:Sd/DIzcUHraKP7BjRgQf3VgfVt
Malware Config
Extracted
risepro
193.233.132.253:50500
Signatures
-
Detects DLL dropped by Raspberry Robin. 5 IoCs
Raspberry Robin.
resource yara_rule behavioral2/memory/4024-10-0x0000000074670000-0x0000000074832000-memory.dmp Raspberry_Robin_DLL_MAY_2022 behavioral2/memory/4024-11-0x0000000074670000-0x0000000074832000-memory.dmp Raspberry_Robin_DLL_MAY_2022 behavioral2/memory/4024-12-0x0000000074670000-0x0000000074832000-memory.dmp Raspberry_Robin_DLL_MAY_2022 behavioral2/memory/4024-17-0x0000000074670000-0x0000000074832000-memory.dmp Raspberry_Robin_DLL_MAY_2022 behavioral2/memory/4024-20-0x0000000074670000-0x0000000074832000-memory.dmp Raspberry_Robin_DLL_MAY_2022 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4024 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4024 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe 4024 54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe"C:\Users\Admin\AppData\Local\Temp\54216089caced6f6d45d6a35dcc47b5640b847d6b3a136d005a73e79c765443d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4024