Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/05/2024, 05:59
Behavioral task
behavioral1
Sample
01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe
Resource
win10v2004-20240426-en
General
-
Target
01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe
-
Size
1.6MB
-
MD5
2f2e36c7cf44716df7af572adba72551
-
SHA1
090b3ed6ad1f1a73f81d2b55becd2f474a7576ff
-
SHA256
01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367
-
SHA512
f8286451e04dc960c751e75dd2e7b65f8941e36141eaf1d08bbd3547eba359624d6576cd689456c91323cb82b6fd701e1493cf5ddb152ed97319af32e9d23efc
-
SSDEEP
24576:L13k6MIhUFvItB8gSfsywvwcmqqQW5f6aNOau+Di8/91enFjOpW2J4Cv:p5hQ6R+2s7sC34NOI2yCv
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
amadey
4.20
c767c0
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amers.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplons.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fd903a8055.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fd903a8055.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fd903a8055.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplons.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplons.exe -
Executes dropped EXE 5 IoCs
pid Process 1512 explorku.exe 252 amers.exe 848 axplons.exe 1876 fd903a8055.exe 1540 axplons.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine axplons.exe Key opened \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Wine amers.exe -
resource yara_rule behavioral2/memory/4980-0-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-2-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-3-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-7-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-8-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-4-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-6-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-5-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/4980-1-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/files/0x000100000002aa14-14.dat themida behavioral2/memory/4980-21-0x0000000000A90000-0x0000000000F8E000-memory.dmp themida behavioral2/memory/1512-29-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-26-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-28-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-30-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-27-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-25-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-23-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-24-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-22-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-31-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1512-40-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/files/0x000100000002aa19-76.dat themida behavioral2/memory/1876-90-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-91-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-93-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-94-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-92-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-95-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-97-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-98-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1876-96-0x00000000004B0000-0x0000000000B36000-memory.dmp themida behavioral2/memory/1512-99-0x0000000000D80000-0x000000000127E000-memory.dmp themida behavioral2/memory/1876-102-0x00000000004B0000-0x0000000000B36000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\fd903a8055.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\fd903a8055.exe" explorku.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fd903a8055.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 252 amers.exe 848 axplons.exe 1540 axplons.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\axplons.job amers.exe File created C:\Windows\Tasks\explorku.job 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 252 amers.exe 252 amers.exe 848 axplons.exe 848 axplons.exe 1540 axplons.exe 1540 axplons.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4980 wrote to memory of 1512 4980 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe 77 PID 4980 wrote to memory of 1512 4980 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe 77 PID 4980 wrote to memory of 1512 4980 01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe 77 PID 1512 wrote to memory of 2400 1512 explorku.exe 78 PID 1512 wrote to memory of 2400 1512 explorku.exe 78 PID 1512 wrote to memory of 2400 1512 explorku.exe 78 PID 1512 wrote to memory of 252 1512 explorku.exe 79 PID 1512 wrote to memory of 252 1512 explorku.exe 79 PID 1512 wrote to memory of 252 1512 explorku.exe 79 PID 252 wrote to memory of 848 252 amers.exe 80 PID 252 wrote to memory of 848 252 amers.exe 80 PID 252 wrote to memory of 848 252 amers.exe 80 PID 1512 wrote to memory of 1876 1512 explorku.exe 81 PID 1512 wrote to memory of 1876 1512 explorku.exe 81 PID 1512 wrote to memory of 1876 1512 explorku.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe"C:\Users\Admin\AppData\Local\Temp\01287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000014001\fd903a8055.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\fd903a8055.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1876
-
-
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5a74a4675ae9de7d4d233cb1dca2ce171
SHA1b9df6e1d6abeb16dd72b88e2a39a482048c70112
SHA256b77ad385f7230a726cfafcb71bd998b7e29921d44bcc82bc1383692279c6c802
SHA512d4c12aea5b8fe5a2a8c0d4823f50c073591036dc86dd4641b8c725aa0baef10264690992ead75b6a999666647c790c36aab088f691a6d01f5649b91d829cbf70
-
Filesize
2.2MB
MD5a728d47242b4ff5ae0d61514fdef5f8f
SHA10597adc779c4f351df4950f529ce8648f5e90b7a
SHA256b03b13cdbb8baecd813a8076a1abf5560cd9a350e2a489e454901356d146b001
SHA512c2920f3dd71cfcf088276cd6fa5a64e9d97c738cbccde806d5236751c7079374f900845e74b743b31db7c161394e773ba8d6229d6bd724e35aa798f5d4bfc551
-
Filesize
1.6MB
MD52f2e36c7cf44716df7af572adba72551
SHA1090b3ed6ad1f1a73f81d2b55becd2f474a7576ff
SHA25601287057c2295ac72f4ffa1f3f83df8c3b380e20ddfe64923b3cc817413a5367
SHA512f8286451e04dc960c751e75dd2e7b65f8941e36141eaf1d08bbd3547eba359624d6576cd689456c91323cb82b6fd701e1493cf5ddb152ed97319af32e9d23efc