Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 05:59
Behavioral task
behavioral1
Sample
01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe
Resource
win10v2004-20240426-en
General
-
Target
01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe
-
Size
1.6MB
-
MD5
2f2e36c7cf44716df7af572adba72551
-
SHA1
090b3ed6ad1f1a73f81d2b55becd2f474a7576ff
-
SHA256
01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367
-
SHA512
f8286451e04dc960c751e75dd2e7b65f8941e36141eaf1d08bbd3547eba359624d6576cd689456c91323cb82b6fd701e1493cf5ddb152ed97319af32e9d23efc
-
SSDEEP
24576:L13k6MIhUFvItB8gSfsywvwcmqqQW5f6aNOau+Di8/91enFjOpW2J4Cv:p5hQ6R+2s7sC34NOI2yCv
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
risepro
147.45.47.126:58709
Extracted
amadey
4.20
c767c0
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amers.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 40bee91304.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 40bee91304.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 40bee91304.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation explorku.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation amers.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe -
Executes dropped EXE 6 IoCs
pid Process 3292 explorku.exe 3612 explorku.exe 4712 amers.exe 912 axplons.exe 2360 40bee91304.exe 324 axplons.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine explorku.exe Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine amers.exe Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Wine axplons.exe -
resource yara_rule behavioral1/memory/2044-2-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-0-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-3-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-1-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-5-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-8-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-7-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-6-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/2044-4-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/files/0x000c0000000226ef-14.dat themida behavioral1/memory/3292-23-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-24-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-30-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-28-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-25-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-29-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-27-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-26-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-22-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/2044-21-0x0000000000A20000-0x0000000000F1E000-memory.dmp themida behavioral1/memory/3292-31-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-39-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3612-44-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/memory/3292-102-0x0000000000D40000-0x000000000123E000-memory.dmp themida behavioral1/files/0x000b0000000233d4-111.dat themida behavioral1/memory/2360-124-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-127-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-126-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-129-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-131-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-130-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-128-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-125-0x0000000000B20000-0x00000000011A6000-memory.dmp themida behavioral1/memory/2360-141-0x0000000000B20000-0x00000000011A6000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40bee91304.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\40bee91304.exe" explorku.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 40bee91304.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 3612 explorku.exe 4712 amers.exe 912 axplons.exe 324 axplons.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3292 set thread context of 3612 3292 explorku.exe 99 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\explorku.job 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe File created C:\Windows\Tasks\axplons.job amers.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3612 explorku.exe 3612 explorku.exe 4712 amers.exe 4712 amers.exe 912 axplons.exe 912 axplons.exe 324 axplons.exe 324 axplons.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2044 wrote to memory of 3292 2044 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe 87 PID 2044 wrote to memory of 3292 2044 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe 87 PID 2044 wrote to memory of 3292 2044 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe 87 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 3612 3292 explorku.exe 99 PID 3292 wrote to memory of 4712 3292 explorku.exe 104 PID 3292 wrote to memory of 4712 3292 explorku.exe 104 PID 3292 wrote to memory of 4712 3292 explorku.exe 104 PID 4712 wrote to memory of 912 4712 amers.exe 105 PID 4712 wrote to memory of 912 4712 amers.exe 105 PID 4712 wrote to memory of 912 4712 amers.exe 105 PID 3292 wrote to memory of 2360 3292 explorku.exe 106 PID 3292 wrote to memory of 2360 3292 explorku.exe 106 PID 3292 wrote to memory of 2360 3292 explorku.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe"C:\Users\Admin\AppData\Local\Temp\01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:912
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000014001\40bee91304.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\40bee91304.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2360
-
-
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5a74a4675ae9de7d4d233cb1dca2ce171
SHA1b9df6e1d6abeb16dd72b88e2a39a482048c70112
SHA256b77ad385f7230a726cfafcb71bd998b7e29921d44bcc82bc1383692279c6c802
SHA512d4c12aea5b8fe5a2a8c0d4823f50c073591036dc86dd4641b8c725aa0baef10264690992ead75b6a999666647c790c36aab088f691a6d01f5649b91d829cbf70
-
Filesize
2.2MB
MD5a728d47242b4ff5ae0d61514fdef5f8f
SHA10597adc779c4f351df4950f529ce8648f5e90b7a
SHA256b03b13cdbb8baecd813a8076a1abf5560cd9a350e2a489e454901356d146b001
SHA512c2920f3dd71cfcf088276cd6fa5a64e9d97c738cbccde806d5236751c7079374f900845e74b743b31db7c161394e773ba8d6229d6bd724e35aa798f5d4bfc551
-
Filesize
1.6MB
MD52f2e36c7cf44716df7af572adba72551
SHA1090b3ed6ad1f1a73f81d2b55becd2f474a7576ff
SHA25601287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367
SHA512f8286451e04dc960c751e75dd2e7b65f8941e36141eaf1d08bbd3547eba359624d6576cd689456c91323cb82b6fd701e1493cf5ddb152ed97319af32e9d23efc