Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

41f98d67e9...d2.exe

windows7-x64

9

41f98d67e9...d2.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 08:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    41f98d67e9537ad119b3d181132bc00196708a5fc1cf76a5fd65cedef3037ad2.exe

  • Size

    104KB

  • MD5

    41beeee2e36acf7c231ddd5b5956e38b

  • SHA1

    5b178def14f47eb7469cb98cf8b793e72ef72d49

  • SHA256

    41f98d67e9537ad119b3d181132bc00196708a5fc1cf76a5fd65cedef3037ad2

  • SHA512

    790fd24f3951ef3fdb8741fdfaa6c2bbd3ca18463b425747a5882013d07a1543ea7967647ea192d9e0dfd812a3180a6547a116c9acb2b9a2535e81e5bcdc3805

  • SSDEEP

    768:RVo0gkvyCr9ktojRMLorOylxVR075gNObwyBeI9TAAmn6Wl606TAAi1ESiMXg+T5:vgU7xQoBBrf07mdpIBF0vrgE+kAA

Score
9/10
discoveryevasionpersistence

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 6 IoCs
    evasion
  • Looks for VirtualBox executables on disk 2 TTPs 1 IoCs
  • Drops file in Drivers directory 12 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 59 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41f98d67e9537ad119b3d181132bc00196708a5fc1cf76a5fd65cedef3037ad2.exe
    "C:\Users\Admin\AppData\Local\Temp\41f98d67e9537ad119b3d181132bc00196708a5fc1cf76a5fd65cedef3037ad2.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Drops file in Drivers directory
    • Looks for VMWare Tools registry key
    • Adds Run key to start application
    • Drops file in System32 directory
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Program Files (x86)\Oracle\VirtualBox Guest Additions\VBoxTray.exe
      C:\Program Files (x86)\Oracle\VirtualBox Guest Additions\VBoxTray.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Windows\SysWOW64\VBoxService.exe
        C:\Windows\system32\VBoxService.exe
        3⤵
        • Looks for VirtualBox executables on disk
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2092
    • C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe
      C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Program Files (x86)\VMware\VMware Tools\vmacthlp.exe
        C:\Program Files (x86)\VMware\VMware Tools\vmacthlp.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4996
    • C:\Program Files (x86)\ollydbg\ollydbg.exe
      C:\Program Files (x86)\ollydbg\ollydbg.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Oracle\VirtualBox Guest Additions\VBoxWHQLFake.exe
    Filesize

    13KB

    MD5

    0043d2c0d39e977e999f581534f72f71

    SHA1

    e2c5b60463fcedea3365f3849a77d847966710fb

    SHA256

    9882426ce9e3357b16ff823f5fceaad31555d189b2748cfe34828692c906f98d

    SHA512

    11ab45b5609f547fee1687e8979960b7e934bd9082e58b3e41a323e7785643047b0805ed3fc59ce2d98346f03d3a43439727fde6485693223b65e8835d905a16

    Download Submit

  • C:\Program Files (x86)\VMware\VMware Tools\vmacthlp.exe
    Filesize

    13KB

    MD5

    1755b50d11f76663959526fe2011098b

    SHA1

    33fd944cca7c1ea6459cb872befae88bb8e4cd56

    SHA256

    c96a604ab35a745ba1b2403f27c0e83220cbcd9e074e440ef8665dd8ca99c72d

    SHA512

    b77b85af29573afedac0e0284178164d27a38d9de5874f2f9b3c30552f1b370f52c84a4fe6f438e0d91d72251cc7cdf4cee82caa651981a33d7c8a43548093be

    Download Submit

  • C:\Program Files (x86)\ollydbg\ollydbg.exe
    Filesize

    13KB

    MD5

    339b1790181080f69ea0ea19b3547ae7

    SHA1

    a8f32eff34a0d736d934f1a4772cf9d5fe6bd062

    SHA256

    0e95472beec6b9bce64b93a0a2eeb2d832294567fe3363a31f0e0e072e325404

    SHA512

    a30367b1a0c228c8cb4462e055bda0d01c6cd263daa98aec9b4e5370ae051116f7944a3c8912db9dd01572568bca1cf2e59f69a2e20962fb09ef8dd099ebd45a

    Download Submit

  • C:\Windows\SysWOW64\VBoxMRXNP.dll
    Filesize

    12KB

    MD5

    17e02d62ea3ff4bf8428d77a72a099e5

    SHA1

    adc3ca460325d753cfce65b27c471227383742e4

    SHA256

    295410a1ae544788babe92c953a3ba533d7353b9222fabf8ad61bfcdac800d0a

    SHA512

    9f2343eff5dd1efda8a9c91acb9e95f298ad6e4a79962c92f3b756bf3c79417276583d1cdd2e68577bec02490c8fe954c85cf370e0ad7ce643729cad571098ad

    Download Submit

  • memory/1052-261-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2092-267-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2512-268-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3020-269-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/4996-270-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/5072-266-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download