Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a13d9f5029...ce.exe

windows7-x64

10

a13d9f5029...ce.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 00:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a13d9f5029f6bb482dbed7bf5e3b607ab40c22475621b9bde1ae140a7827c2ce.exe

  • Size

    2.5MB

  • MD5

    74cd7d9b53e908bcfb3c47524e941301

  • SHA1

    a49cae44c318405c3a1d46d79112819f8631c876

  • SHA256

    a13d9f5029f6bb482dbed7bf5e3b607ab40c22475621b9bde1ae140a7827c2ce

  • SHA512

    52d0d4d03c76c498f7a05520fa3d45bed8f493687e076ccea6f96ae7798bcb0e194ba0f67ce749306f1dd779670de38ed8f805b5d49d403e4b366b33a3d3c8d4

  • SSDEEP

    49152:YxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:Yxx9NUFkQx753uWuCyyxg

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Detects executables packed with Themida 18 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a13d9f5029f6bb482dbed7bf5e3b607ab40c22475621b9bde1ae140a7827c2ce.exe
    "C:\Users\Admin\AppData\Local\Temp\a13d9f5029f6bb482dbed7bf5e3b607ab40c22475621b9bde1ae140a7827c2ce.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:224
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1068
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1404
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4988
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    2.5MB

    MD5

    ed45521544e9ace0c0e3b0219babbb9a

    SHA1

    50b8f70cb0022ca18c84ac5f338ef89366d33244

    SHA256

    637d18ea2560ed94a8c7f68d1a7266439b5574684ba870eb91cd2661afc22b62

    SHA512

    510b7af911b2c389435d69f252353c83be7b5f192a7acdacb6432ced767d4459528bd9a957e04470c71bf107e8f993619b0d7d19bd86ce77df5c348dadb87a42

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    2.5MB

    MD5

    f40383846e8b4663c41a40f60f48d8ff

    SHA1

    f7bbd92b45e42eca9d2328db01ab22c5c297b369

    SHA256

    2102d53b6667ac75339b3034a0c049688e8bf05b8204f015eebece6a5cdef57e

    SHA512

    fb593eb722859f237a3494284cd97a3f215891fb73836d6bbd07454bcee04e6624074577f82e269f3202d67a097e5a7253a41ada0e05b30e33e2591b8d6c11cd

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    2.5MB

    MD5

    692e1b529266ef3fc6b78e921bfe4f4f

    SHA1

    07b6e2aa638e68b4539f27ec8f58e9b621ebdb6e

    SHA256

    30faf74331d3f175a535b1534d88a4d5eec2cbdb6280724b62242c920c6480d5

    SHA512

    14d6e422198a4caa0492f514814b0e29c7954bc4a9771419c406c7a1e07d95ba019cece1e077e569ecb795ae151a398b07147199486248c429d837751fb219d0

    Download Submit

  • memory/224-1-0x0000000077664000-0x0000000077666000-memory.dmp

    Filesize

    8KB

    Download

  • memory/224-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/224-41-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1068-43-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1068-10-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1068-45-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1068-57-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1068-67-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1404-42-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1404-19-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/2800-33-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/2800-38-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4988-28-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4988-44-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4988-48-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4988-52-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

    Download