Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
OneDrive.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OneDrive.exe
Resource
win10v2004-20240508-en
General
-
Target
OneDrive.exe
-
Size
9.9MB
-
MD5
85c6f8629ff03c6c9b7135ed3c382ae0
-
SHA1
299c09ba616df6996299e217980144ca7e4ac98c
-
SHA256
25f3f0c03663754228aee619281fed809ccf271d6a1f427829aca20e737f6c85
-
SHA512
64dd53613f65fea2b234db9ddeaa822a8173492029cdb96306627b4459c4bf082e6d1192adc376421ee0ddeb0a65c9d783b65892645ad09a4b620a3e6e8a1d9a
-
SSDEEP
196608:y/iPymidOfdSSd3QsPXD14pbuGuPDv6Mw2mYePsCwRx9xB82tE4dWr5Tf3:y/iosfdPAsPBC9Yeu8WWdTP
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ OneDrive.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2612 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion OneDrive.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion OneDrive.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OneDrive.exe" OneDrive.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OneDrive.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2164 OneDrive.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2164 OneDrive.exe 2612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2612 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2892 2164 OneDrive.exe 28 PID 2164 wrote to memory of 2892 2164 OneDrive.exe 28 PID 2164 wrote to memory of 2892 2164 OneDrive.exe 28 PID 2164 wrote to memory of 2892 2164 OneDrive.exe 28 PID 2892 wrote to memory of 2612 2892 cmd.exe 30 PID 2892 wrote to memory of 2612 2892 cmd.exe 30 PID 2892 wrote to memory of 2612 2892 cmd.exe 30 PID 2892 wrote to memory of 2612 2892 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.execmd.exe /c powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Public2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Users\Public3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-