Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2024, 22:29
Behavioral task
behavioral1
Sample
538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe
Resource
win10v2004-20240508-en
General
-
Target
538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe
-
Size
1.6MB
-
MD5
2a10e78245f345f0bb53d6d81759668e
-
SHA1
a1c000a55b35ff37db08647f1682c9aabeb2ebe2
-
SHA256
538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a
-
SHA512
69c5e504096c802169f0b8e70d05573f022cf0d8b7c71945e14c232afaba218c84b365f0ccfeb87bfd8ecb7a9e1947b216e9ded463a435bc9db08acdff3e20f8
-
SSDEEP
24576:rBl8dzWobnGQOEMlWAzFaG05gay5GWG4aboYut9OHYIRDDfZNZTOKTxqgpy799+:dqbbnOEMlNzF305gayQ4PqZRfrlYg8RM
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
amadey
4.20
c767c0
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amers.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 0d02573be8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0d02573be8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0d02573be8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation explorku.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation amers.exe -
Executes dropped EXE 10 IoCs
pid Process 4936 explorku.exe 1548 amers.exe 3736 axplons.exe 1760 0d02573be8.exe 3988 explorku.exe 2516 axplons.exe 996 explorku.exe 320 axplons.exe 2668 axplons.exe 5044 explorku.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine amers.exe -
resource yara_rule behavioral1/memory/996-3-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-2-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-7-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-5-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-1-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-0-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-6-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/996-4-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/files/0x00070000000233cc-13.dat themida behavioral1/memory/996-20-0x0000000000B70000-0x0000000001071000-memory.dmp themida behavioral1/memory/4936-21-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-22-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-24-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-26-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-28-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-27-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-25-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-23-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-47-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/files/0x00070000000233d4-67.dat themida behavioral1/memory/1760-81-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-83-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-85-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-84-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-82-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-86-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-87-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-89-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/1760-88-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/3988-92-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-96-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-100-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-98-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-97-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-94-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-95-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-99-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/3988-102-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/4936-104-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/1760-106-0x0000000000E80000-0x00000000014FB000-memory.dmp themida behavioral1/memory/996-132-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-125-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-127-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-131-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-130-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-129-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-128-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-126-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/996-134-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/5044-164-0x00000000001A0000-0x00000000006A1000-memory.dmp themida behavioral1/memory/5044-166-0x00000000001A0000-0x00000000006A1000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0d02573be8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\0d02573be8.exe" explorku.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0d02573be8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1548 amers.exe 3736 axplons.exe 2516 axplons.exe 320 axplons.exe 2668 axplons.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\explorku.job 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe File created C:\Windows\Tasks\axplons.job amers.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1548 amers.exe 1548 amers.exe 3736 axplons.exe 3736 axplons.exe 2516 axplons.exe 2516 axplons.exe 320 axplons.exe 320 axplons.exe 2668 axplons.exe 2668 axplons.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 996 wrote to memory of 4936 996 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe 82 PID 996 wrote to memory of 4936 996 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe 82 PID 996 wrote to memory of 4936 996 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe 82 PID 4936 wrote to memory of 4860 4936 explorku.exe 88 PID 4936 wrote to memory of 4860 4936 explorku.exe 88 PID 4936 wrote to memory of 4860 4936 explorku.exe 88 PID 4936 wrote to memory of 1548 4936 explorku.exe 90 PID 4936 wrote to memory of 1548 4936 explorku.exe 90 PID 4936 wrote to memory of 1548 4936 explorku.exe 90 PID 1548 wrote to memory of 3736 1548 amers.exe 91 PID 1548 wrote to memory of 3736 1548 amers.exe 91 PID 1548 wrote to memory of 3736 1548 amers.exe 91 PID 4936 wrote to memory of 1760 4936 explorku.exe 93 PID 4936 wrote to memory of 1760 4936 explorku.exe 93 PID 4936 wrote to memory of 1760 4936 explorku.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe"C:\Users\Admin\AppData\Local\Temp\538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵PID:4860
-
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000014001\0d02573be8.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\0d02573be8.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1760
-
-
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2516
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3988
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:996
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:320
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5fc40addc1c7501127359a023fbff7d46
SHA1923a1d921fc5f0c1495fb44ef35c2d325711eca1
SHA2567dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d
SHA512991a418959b0d5338b3381907fe98a08cfb6a7974ec104acfa1544f9b09fbb0bf339cf4b47b49ffab100db10d78035c699571f9ad1eec7d39e4ba85562c3da70
-
Filesize
2.1MB
MD5872236a902af065fbfd08e87981cf1c8
SHA1d8def79f1130f3914eb2e201729c478e8d5ec3d4
SHA256ddfe1323dfacf3a16696f5831e02b851ef2597e113a01aef8b1688c44f92baa6
SHA5127f3e73b60bbd0a720f0a320813fe6db8276cf5f0c5e00863678f5337443245de1a2f1591a705af24140a662602b90ef2af67adff2edf0fe7389136a2f619fefc
-
Filesize
1.6MB
MD52a10e78245f345f0bb53d6d81759668e
SHA1a1c000a55b35ff37db08647f1682c9aabeb2ebe2
SHA256538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a
SHA51269c5e504096c802169f0b8e70d05573f022cf0d8b7c71945e14c232afaba218c84b365f0ccfeb87bfd8ecb7a9e1947b216e9ded463a435bc9db08acdff3e20f8