Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 04:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
vmixer.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
vmixer.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
vmixer.exe
-
Size
14.5MB
-
MD5
da2a344c0338220684308fa5f9b4c6cf
-
SHA1
3b0eb0e94606f9f1834a2241445d891abf1d3ac6
-
SHA256
fe341202c0bf771497542849387ff096823a03184ddc4cdadb72179673665e75
-
SHA512
c74bdd776d3cb2dd59755e6ecee6bdb65e7e6be753e1fb7731e309e97a9d1d922dd117b5a2392bae008a9e2ce8b92e0cc8099fe260c8c431fffe6bb87e65deb6
-
SSDEEP
393216:eVKCIfyGEeBw5VKXokQNGD51hXeqQpxEO0WO:VC/GhwHjNGvhXe/pxEO0J
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hookmgr\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\hookmgr.sys" vmixer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2084 set thread context of 2100 2084 vmixer.exe 28 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2516 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 vmixer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2100 vmixer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 2100 vmixer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe 2100 vmixer.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2100 2084 vmixer.exe 28 PID 2084 wrote to memory of 2100 2084 vmixer.exe 28 PID 2084 wrote to memory of 2100 2084 vmixer.exe 28 PID 2084 wrote to memory of 2100 2084 vmixer.exe 28 PID 2084 wrote to memory of 2100 2084 vmixer.exe 28 PID 2084 wrote to memory of 2100 2084 vmixer.exe 28 PID 2100 wrote to memory of 2516 2100 vmixer.exe 29 PID 2100 wrote to memory of 2516 2100 vmixer.exe 29 PID 2100 wrote to memory of 2516 2100 vmixer.exe 29 PID 2100 wrote to memory of 2516 2100 vmixer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmixer.exe"C:\Users\Admin\AppData\Local\Temp\vmixer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\vmixer.exe"C:\Users\Admin\AppData\Local\Temp\vmixer.exe"2⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN Update\vmixer.exe /XML "C:\Users\Admin\AppData\Local\Temp\data2.xml"3⤵
- Creates scheduled task(s)
PID:2516
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d1fa021e9ef57e59be8d9e16ae0dc6be
SHA1d57e701ce16d59e7bfe8203c2833ed6ce033c5a4
SHA256570da2d9480ff73c0c47f1dfb2ac368aefb9d07601abaff8ab3cca39d4769ae6
SHA51248449d69881e517959ca53a621d0f07e6773569d48953eab3cd23feb7f7118e177249b5526b3b55f275751ebbad1d31d977b7406a8ea35da8a4ada17a2df2329