Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

c337a60974...c0.exe

windows7-x64

10

c337a60974...c0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 05:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe

  • Size

    2.5MB

  • MD5

    f908e496fd10a760b9fbdd64b2101c21

  • SHA1

    aa32263197cfe9ce4d043d762547f45f2d8026b0

  • SHA256

    c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0

  • SHA512

    1a3407d52d319972f6fb780f1dce978feab9ef206ee12c0248c83d994ac027e5b9186971a3234e5983e7ac78e6fd0fe3d6c5fba3b79ef7dbb6435846d9fc7db7

  • SSDEEP

    49152:MxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxy:Mxx9NUFkQx753uWuCyyxy

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Detects executables packed with Themida 15 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Themida packer 15 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe
    "C:\Users\Admin\AppData\Local\Temp\c337a60974844bbe579fc933b065989fdb5a66350acfaa7952465c0e73a28ec0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4436
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3352
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:544
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3732
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:3760
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4512

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\Themes\explorer.exe
      Filesize

      2.5MB

      MD5

      ca50f940df512babfc1fdb75059d631a

      SHA1

      4f9b7725ab921fa64ec607b4ed69b5f299f3d79f

      SHA256

      732aea2a725e9c4d0edaffe5031772dcd2fc4d2d3e0cafa526d76a9618895c3d

      SHA512

      20a4fe597aabe39dadaca2458ee41f623b97b73ff3b8651dae67d0eaaf6987aa13dc3bb1895dcb1bac6bd19b4c7ef764c072de3cee9a2f60a9536a0bff4644e2

      Download Submit

    • C:\Windows\Resources\spoolsv.exe
      Filesize

      2.5MB

      MD5

      df45c05cb6d43ae480cdc38c91757ee5

      SHA1

      3b6c528304a57517846f7a34bee94d157fe3c6c9

      SHA256

      81a8bc67a7d85c07b1f2becc7f4f7d460ef78249323b99caf9f3e9ced8fd20ef

      SHA512

      c0057f4e072ac8a58bd7a17a7f39b40512a2226907b0db7af70ff7a1803ce4cfa32575d3da87fa911a0ac7966c5da5f38efcb341552a080e3f14666299a28d83

      Download Submit

    • C:\Windows\Resources\svchost.exe
      Filesize

      2.5MB

      MD5

      105973d481ac7ce3296d22a5b51d8d2b

      SHA1

      eb30a7fe7ec223e74ffd2e01cab323f62b6ca425

      SHA256

      5a038d8f40bc13a4e9413392389af3160e220d86f311c7c857cba113d647a045

      SHA512

      8b399e490e200bb06a26efd4e65d20a03d9f5a6d13f97fb87d8ad7c195a0f745defce726759a436a527418287be1264154f9ff7fb5809c833faf2cdfc06051c1

      Download Submit

    • memory/544-38-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/544-19-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3352-66-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3352-10-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3352-54-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3352-41-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3732-42-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3732-45-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3732-28-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3760-36-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/4436-40-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/4436-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/4436-1-0x00000000778D4000-0x00000000778D6000-memory.dmp

      Filesize

      8KB

      Download