Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
26/04/2024, 16:04
240426-thygmafb72 926/04/2024, 15:39
240426-s3w9mafe8t 926/04/2024, 15:06
240426-sg9mtseb45 9Analysis
-
max time kernel
309s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 15:39
Behavioral task
behavioral1
Sample
IP.exe
Resource
win10v2004-20240426-en
General
-
Target
IP.exe
-
Size
20.2MB
-
MD5
e72253d9c42192ba62b5e2552bbfbca4
-
SHA1
065af9ed0ec5d6d4b40c6dcf76e847b98b2572d2
-
SHA256
2208dc3c8ca0aa3456e5f562b8f338be4bdc5270a488a9e44e5c4f6a972a792d
-
SHA512
155879bbc185ce9df1b62f9ff9e0147cf99d5514004e92b8812bcec76783ad958dfaaf73ed6ddca99f2b942605a3b0a07156e12a1342241ad780d178a5074f4f
-
SSDEEP
393216:Ha5opL76qeFJ/KqbG1scz01nJr0dUMv3htIVCiOV82RqYBof8IuQK9CpBiz6:H5aJ/iFar09tIVCHR5ofKwpBQ6
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ unsecapp.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ IP.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion unsecapp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion unsecapp.exe -
Executes dropped EXE 1 IoCs
pid Process 1020 unsecapp.exe -
resource yara_rule behavioral1/memory/3540-0-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-3-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-4-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-2-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-8-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-7-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-5-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-6-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-9-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/files/0x0007000000023427-20.dat themida behavioral1/memory/1020-29-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-32-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-34-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-33-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-31-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-36-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-37-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-35-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/3540-38-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/3540-39-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp themida behavioral1/memory/1020-41-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-42-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-43-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-44-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-45-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-46-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-47-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-48-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-49-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-50-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-51-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-52-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-53-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-54-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-55-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-56-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-57-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-58-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-59-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-60-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-61-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-62-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-63-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-64-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-65-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-66-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-67-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-68-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida behavioral1/memory/1020-69-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhostw.exe" IP.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA unsecapp.exe -
AutoIT Executable 44 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3540-3-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-4-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-8-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-7-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-5-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-6-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-9-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/1020-32-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-34-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-33-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-36-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-37-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-35-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/3540-38-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/3540-39-0x00007FF6C0D80000-0x00007FF6C2C37000-memory.dmp autoit_exe behavioral1/memory/1020-41-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-42-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-43-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-44-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-45-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-46-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-47-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-48-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-49-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-50-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-51-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-52-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-53-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-54-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-55-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-56-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-57-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-58-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-59-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-60-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-61-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-62-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-63-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-64-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-65-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-66-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-67-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-68-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe behavioral1/memory/1020-69-0x00007FF68AEA0000-0x00007FF68C49E000-memory.dmp autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\unsecapp.exe IP.exe File opened for modification C:\Windows\SysWOW64\unsecapp.exe IP.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3540 IP.exe 1020 unsecapp.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\ IP.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\WinMgmts:\ IP.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 3540 IP.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe 1020 unsecapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1020 unsecapp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3540 wrote to memory of 1020 3540 IP.exe 83 PID 3540 wrote to memory of 1020 3540 IP.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\IP.exe"C:\Users\Admin\AppData\Local\Temp\IP.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\unsecapp.exeC:\Windows\SysWOW64\unsecapp.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1020
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD5f41ac8c7f6f7871848ddb6fb718a15bb
SHA1bce00d05c76d0a4eedbd76c2e87fc55c644edac0
SHA256d30a26d6f6676d700f86db8ff522cccfea285e1272f2dba210cf99c3b676a773
SHA51262316becb846b12396401fdb79c14ada97495abdd241fe4815c963d6ea315989bc6f283ff68c17cd90e5b62d3ea025770f4883b2b1f387d0dbe2d41a1c541ba6