Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 20:41
Behavioral task
behavioral1
Sample
HAXCS2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
HAXCS2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
protect.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
protect.exe
Resource
win10v2004-20240426-en
General
-
Target
HAXCS2.exe
-
Size
4.3MB
-
MD5
6acbf564dca6f58c3af2e92b245bacbb
-
SHA1
c3945f257fed5508cdf13db3babe8f4a8951af44
-
SHA256
86a4f5a9a35d13b173802ca596815aacdeed2a73168fc937befed0e7c790c139
-
SHA512
dc7d1a1f2f4d97f12faea67fc5783c525fad1eb0b1c8caedc83014e51cbbcd2c8a66592acc2d94fc84a25e2b3a90ba922d3c9e3073e9a495f11e0ebd055facf9
-
SSDEEP
98304:Eh9dxpuiFLvbQaU397ndYbA9ufAkD9jII/td5aZXtsAVnZhV3d:EbTp5LD897cAgfAkD900E9sA1Z73d
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ HAXCS2.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion HAXCS2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion HAXCS2.exe -
resource yara_rule behavioral1/memory/2264-0-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-5-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-3-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-2-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-4-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-7-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-8-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-6-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-9-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-10-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-11-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-12-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-13-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-14-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-15-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-16-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-17-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-18-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-19-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-20-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-21-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-22-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-23-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida behavioral1/memory/2264-24-0x000000013F3B0000-0x000000013FEAA000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA HAXCS2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2264 HAXCS2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe 2264 HAXCS2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HAXCS2.exe"C:\Users\Admin\AppData\Local\Temp\HAXCS2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2264