Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/05/2024, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe
Resource
win10v2004-20240508-en
General
-
Target
efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe
-
Size
1.8MB
-
MD5
cd6c579cfcb9bae246f8d572871b287e
-
SHA1
9107eb0f184e0b474e875eb33aec5a7ee404fc28
-
SHA256
efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6
-
SHA512
10bfc8f6972bcba99a5e5c6000eeab625f150a19c9eea9d88cb9c9f6dc60a8e2097cd71e69d73690deec6a800452f1587c9739f7de314e77ebda4a252e321e91
-
SSDEEP
49152:6jpTfaQ241PKkQL0a8r+63cfjvypiFhzwIW5rYXga:2TyQ2APkHYsfjqohcnrYXH
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
risepro
147.45.47.126:58709
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7f936bf383.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 9b0e2d08f1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplont.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explortu.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9b0e2d08f1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9b0e2d08f1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explortu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7f936bf383.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7f936bf383.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplont.exe -
Executes dropped EXE 10 IoCs
pid Process 3036 explortu.exe 4756 7f936bf383.exe 2428 9b0e2d08f1.exe 3076 axplont.exe 1492 explortu.exe 3488 axplont.exe 4604 explortu.exe 1984 axplont.exe 1340 explortu.exe 3872 axplont.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine 7f936bf383.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine explortu.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine 9b0e2d08f1.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe Key opened \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine axplont.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b0e2d08f1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\9b0e2d08f1.exe" explortu.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
pid Process 2404 efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe 3036 explortu.exe 4756 7f936bf383.exe 2428 9b0e2d08f1.exe 3076 axplont.exe 1492 explortu.exe 3488 axplont.exe 4604 explortu.exe 1984 axplont.exe 1340 explortu.exe 3872 axplont.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\explortu.job efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe File created C:\Windows\Tasks\axplont.job 7f936bf383.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2404 efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe 2404 efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe 3036 explortu.exe 3036 explortu.exe 4756 7f936bf383.exe 4756 7f936bf383.exe 2428 9b0e2d08f1.exe 2428 9b0e2d08f1.exe 3076 axplont.exe 3076 axplont.exe 1492 explortu.exe 1492 explortu.exe 3488 axplont.exe 3488 axplont.exe 4604 explortu.exe 4604 explortu.exe 1984 axplont.exe 1984 axplont.exe 1340 explortu.exe 1340 explortu.exe 3872 axplont.exe 3872 axplont.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2404 wrote to memory of 3036 2404 efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe 76 PID 2404 wrote to memory of 3036 2404 efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe 76 PID 2404 wrote to memory of 3036 2404 efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe 76 PID 3036 wrote to memory of 1556 3036 explortu.exe 77 PID 3036 wrote to memory of 1556 3036 explortu.exe 77 PID 3036 wrote to memory of 1556 3036 explortu.exe 77 PID 3036 wrote to memory of 4756 3036 explortu.exe 78 PID 3036 wrote to memory of 4756 3036 explortu.exe 78 PID 3036 wrote to memory of 4756 3036 explortu.exe 78 PID 3036 wrote to memory of 2428 3036 explortu.exe 79 PID 3036 wrote to memory of 2428 3036 explortu.exe 79 PID 3036 wrote to memory of 2428 3036 explortu.exe 79 PID 4756 wrote to memory of 3076 4756 7f936bf383.exe 80 PID 4756 wrote to memory of 3076 4756 7f936bf383.exe 80 PID 4756 wrote to memory of 3076 4756 7f936bf383.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe"C:\Users\Admin\AppData\Local\Temp\efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵PID:1556
-
-
C:\Users\Admin\1000004002\7f936bf383.exe"C:\Users\Admin\1000004002\7f936bf383.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\9b0e2d08f1.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\9b0e2d08f1.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1492
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1340
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5b5f49ea48bd953e7fdf40e250be52086
SHA124e385f539225596258193b66a9a24929616612f
SHA25662bd4a50cdbd1adda3a0d82a1f27bddc872ccf9c232be064033efd9feb531ed2
SHA51293eed99f7581df3e082dc08a19124d5f09118d70aa3559ee7f1c74ea13f2cdeac85bfff453b5529962596f317113e7be75ee6bf7d56724c8c4adb4816cbad522
-
Filesize
2.3MB
MD5c1fa27ad9d47cc1c4b35ce3cb0bf1a35
SHA194bf0f0fb1393111f2a1c048c42665fb6ba595c9
SHA2564762b2238b692ae0361a701516467ad8e46c0c9ac2a53518e16df165ab1ab5be
SHA51212993b9d29767f47010ab46193ae1e94780b1d61178fbe287e3c0acff0a38990ccc92bed6f954ed295c8ed4d831db9ec9e259925149f8cb1eacdc77e82f5b17d
-
Filesize
1.8MB
MD5cd6c579cfcb9bae246f8d572871b287e
SHA19107eb0f184e0b474e875eb33aec5a7ee404fc28
SHA256efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6
SHA51210bfc8f6972bcba99a5e5c6000eeab625f150a19c9eea9d88cb9c9f6dc60a8e2097cd71e69d73690deec6a800452f1587c9739f7de314e77ebda4a252e321e91