Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 04:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
vmixer.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
vmixer.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
vmixer.exe
-
Size
14.5MB
-
MD5
da2a344c0338220684308fa5f9b4c6cf
-
SHA1
3b0eb0e94606f9f1834a2241445d891abf1d3ac6
-
SHA256
fe341202c0bf771497542849387ff096823a03184ddc4cdadb72179673665e75
-
SHA512
c74bdd776d3cb2dd59755e6ecee6bdb65e7e6be753e1fb7731e309e97a9d1d922dd117b5a2392bae008a9e2ce8b92e0cc8099fe260c8c431fffe6bb87e65deb6
-
SSDEEP
393216:eVKCIfyGEeBw5VKXokQNGD51hXeqQpxEO0WO:VC/GhwHjNGvhXe/pxEO0J
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hookmgr\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\hookmgr.sys" vmixer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2080 set thread context of 3656 2080 vmixer.exe 85 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2224 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3656 vmixer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3656 vmixer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 3656 vmixer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe 3656 vmixer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2080 wrote to memory of 3656 2080 vmixer.exe 85 PID 2080 wrote to memory of 3656 2080 vmixer.exe 85 PID 2080 wrote to memory of 3656 2080 vmixer.exe 85 PID 2080 wrote to memory of 3656 2080 vmixer.exe 85 PID 2080 wrote to memory of 3656 2080 vmixer.exe 85 PID 3656 wrote to memory of 2224 3656 vmixer.exe 90 PID 3656 wrote to memory of 2224 3656 vmixer.exe 90 PID 3656 wrote to memory of 2224 3656 vmixer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\vmixer.exe"C:\Users\Admin\AppData\Local\Temp\vmixer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\vmixer.exe"C:\Users\Admin\AppData\Local\Temp\vmixer.exe"2⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN Update\vmixer.exe /XML "C:\Users\Admin\AppData\Local\Temp\data2.xml"3⤵
- Creates scheduled task(s)
PID:2224
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d1fa021e9ef57e59be8d9e16ae0dc6be
SHA1d57e701ce16d59e7bfe8203c2833ed6ce033c5a4
SHA256570da2d9480ff73c0c47f1dfb2ac368aefb9d07601abaff8ab3cca39d4769ae6
SHA51248449d69881e517959ca53a621d0f07e6773569d48953eab3cd23feb7f7118e177249b5526b3b55f275751ebbad1d31d977b7406a8ea35da8a4ada17a2df2329