Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/05/2024, 22:29
Behavioral task
behavioral1
Sample
538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe
Resource
win10v2004-20240508-en
General
-
Target
538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe
-
Size
1.6MB
-
MD5
2a10e78245f345f0bb53d6d81759668e
-
SHA1
a1c000a55b35ff37db08647f1682c9aabeb2ebe2
-
SHA256
538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a
-
SHA512
69c5e504096c802169f0b8e70d05573f022cf0d8b7c71945e14c232afaba218c84b365f0ccfeb87bfd8ecb7a9e1947b216e9ded463a435bc9db08acdff3e20f8
-
SSDEEP
24576:rBl8dzWobnGQOEMlWAzFaG05gay5GWG4aboYut9OHYIRDDfZNZTOKTxqgpy799+:dqbbnOEMlNzF305gayQ4PqZRfrlYg8RM
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
amadey
4.20
c767c0
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amers.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4adc7cf67c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4adc7cf67c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4adc7cf67c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe -
Executes dropped EXE 10 IoCs
pid Process 1408 explorku.exe 4988 amers.exe 956 axplons.exe 2972 4adc7cf67c.exe 3140 axplons.exe 596 explorku.exe 2876 axplons.exe 2992 explorku.exe 852 axplons.exe 3544 explorku.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine amers.exe -
resource yara_rule behavioral2/memory/1304-0-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-1-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-2-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-4-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-3-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-5-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-6-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1304-7-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/files/0x000100000002a9c8-13.dat themida behavioral2/memory/1408-26-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-27-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-25-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-28-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-24-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-22-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-23-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1408-21-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/1304-20-0x0000000000160000-0x0000000000661000-memory.dmp themida behavioral2/memory/1408-62-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/files/0x000100000002a9cd-67.dat themida behavioral2/memory/2972-84-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-85-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-86-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-88-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-89-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-87-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-83-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-82-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2972-81-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/1408-91-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-97-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-100-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-102-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-101-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-99-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-98-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-95-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-96-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/596-104-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2972-108-0x0000000000E70000-0x00000000014EB000-memory.dmp themida behavioral2/memory/2992-129-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-130-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-136-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-134-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-133-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-132-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-135-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-131-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/2992-138-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/3544-161-0x0000000000750000-0x0000000000C51000-memory.dmp themida behavioral2/memory/3544-170-0x0000000000750000-0x0000000000C51000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\4adc7cf67c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\4adc7cf67c.exe" explorku.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4adc7cf67c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4988 amers.exe 956 axplons.exe 3140 axplons.exe 2876 axplons.exe 852 axplons.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\axplons.job amers.exe File created C:\Windows\Tasks\explorku.job 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4988 amers.exe 4988 amers.exe 956 axplons.exe 956 axplons.exe 3140 axplons.exe 3140 axplons.exe 2876 axplons.exe 2876 axplons.exe 852 axplons.exe 852 axplons.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1408 1304 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe 80 PID 1304 wrote to memory of 1408 1304 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe 80 PID 1304 wrote to memory of 1408 1304 538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe 80 PID 1408 wrote to memory of 3608 1408 explorku.exe 82 PID 1408 wrote to memory of 3608 1408 explorku.exe 82 PID 1408 wrote to memory of 3608 1408 explorku.exe 82 PID 1408 wrote to memory of 4988 1408 explorku.exe 83 PID 1408 wrote to memory of 4988 1408 explorku.exe 83 PID 1408 wrote to memory of 4988 1408 explorku.exe 83 PID 4988 wrote to memory of 956 4988 amers.exe 84 PID 4988 wrote to memory of 956 4988 amers.exe 84 PID 4988 wrote to memory of 956 4988 amers.exe 84 PID 1408 wrote to memory of 2972 1408 explorku.exe 85 PID 1408 wrote to memory of 2972 1408 explorku.exe 85 PID 1408 wrote to memory of 2972 1408 explorku.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe"C:\Users\Admin\AppData\Local\Temp\538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵PID:3608
-
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:956
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000014001\4adc7cf67c.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\4adc7cf67c.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2972
-
-
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:596
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2876
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2992
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:852
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5fc40addc1c7501127359a023fbff7d46
SHA1923a1d921fc5f0c1495fb44ef35c2d325711eca1
SHA2567dfde5c31ba90e045fd5a3be2eb5797cf6dbbf56d59f6a49b3c0dc8c60a08e2d
SHA512991a418959b0d5338b3381907fe98a08cfb6a7974ec104acfa1544f9b09fbb0bf339cf4b47b49ffab100db10d78035c699571f9ad1eec7d39e4ba85562c3da70
-
Filesize
2.1MB
MD5872236a902af065fbfd08e87981cf1c8
SHA1d8def79f1130f3914eb2e201729c478e8d5ec3d4
SHA256ddfe1323dfacf3a16696f5831e02b851ef2597e113a01aef8b1688c44f92baa6
SHA5127f3e73b60bbd0a720f0a320813fe6db8276cf5f0c5e00863678f5337443245de1a2f1591a705af24140a662602b90ef2af67adff2edf0fe7389136a2f619fefc
-
Filesize
1.6MB
MD52a10e78245f345f0bb53d6d81759668e
SHA1a1c000a55b35ff37db08647f1682c9aabeb2ebe2
SHA256538639c6e1d1ec1dc43d95d7ea12b6376c89294904c5b14560455235d7b4391a
SHA51269c5e504096c802169f0b8e70d05573f022cf0d8b7c71945e14c232afaba218c84b365f0ccfeb87bfd8ecb7a9e1947b216e9ded463a435bc9db08acdff3e20f8