Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 16:04
Static task
static1
Behavioral task
behavioral1
Sample
b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe
Resource
win10v2004-20240508-en
General
-
Target
b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe
-
Size
1.8MB
-
MD5
e2de3ad7601e5370da34efa79c574892
-
SHA1
92968a543b0b550f8aee3fbd0dcb09d3a1796c2b
-
SHA256
b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502
-
SHA512
6150a9e7f7b040dbfd10c0bcde6fb45c879877a20dc4c0cb5d26f64cf6a2db0f6b3b7d9d3813a0a200ca5dfe88d778275bb3ab1b7581584dffac4c61fe5bd565
-
SSDEEP
49152:YsM6dHY5O/Wu52bxX92OiWO7a0oS9OESiW49yi9Yc:Ys3dHB/l5wxX9dSagMESidYc
Malware Config
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Extracted
stealc
default
http://85.28.47.4
-
url_path
/920475a59bac849d.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BGDBAKFCFH.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BGDBAKFCFH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BGDBAKFCFH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation explorti.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation bf696612f1.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 6 IoCs
pid Process 3720 explorti.exe 2712 bf696612f1.exe 884 explorti.exe 2284 BGDBAKFCFH.exe 4824 explorti.exe 1580 explorti.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine BGDBAKFCFH.exe Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine explorti.exe -
Loads dropped DLL 2 IoCs
pid Process 2712 bf696612f1.exe 2712 bf696612f1.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
pid Process 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe 3720 explorti.exe 2712 bf696612f1.exe 2712 bf696612f1.exe 2712 bf696612f1.exe 884 explorti.exe 2712 bf696612f1.exe 2712 bf696612f1.exe 2284 BGDBAKFCFH.exe 4824 explorti.exe 1580 explorti.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\explorti.job b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bf696612f1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bf696612f1.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe 3720 explorti.exe 3720 explorti.exe 884 explorti.exe 884 explorti.exe 2712 bf696612f1.exe 2712 bf696612f1.exe 2712 bf696612f1.exe 2712 bf696612f1.exe 2284 BGDBAKFCFH.exe 2284 BGDBAKFCFH.exe 4824 explorti.exe 4824 explorti.exe 1580 explorti.exe 1580 explorti.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2712 bf696612f1.exe 3164 cmd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1100 wrote to memory of 3720 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe 83 PID 1100 wrote to memory of 3720 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe 83 PID 1100 wrote to memory of 3720 1100 b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe 83 PID 3720 wrote to memory of 2712 3720 explorti.exe 88 PID 3720 wrote to memory of 2712 3720 explorti.exe 88 PID 3720 wrote to memory of 2712 3720 explorti.exe 88 PID 2712 wrote to memory of 1836 2712 bf696612f1.exe 95 PID 2712 wrote to memory of 1836 2712 bf696612f1.exe 95 PID 2712 wrote to memory of 1836 2712 bf696612f1.exe 95 PID 2712 wrote to memory of 3164 2712 bf696612f1.exe 97 PID 2712 wrote to memory of 3164 2712 bf696612f1.exe 97 PID 2712 wrote to memory of 3164 2712 bf696612f1.exe 97 PID 1836 wrote to memory of 2284 1836 cmd.exe 99 PID 1836 wrote to memory of 2284 1836 cmd.exe 99 PID 1836 wrote to memory of 2284 1836 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe"C:\Users\Admin\AppData\Local\Temp\b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\1000006001\bf696612f1.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\bf696612f1.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BGDBAKFCFH.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\BGDBAKFCFH.exe"C:\Users\Admin\AppData\Local\Temp\BGDBAKFCFH.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EGDGIEGHJE.exe"4⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3164
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:884
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
2.4MB
MD5773e8af03da6e64f25166e7df67d71fe
SHA1db43e8714ce1c8d496e0eef1f9f61fafa5dfa0ad
SHA25603b6b9b10aad113cb8e9bd43d0ed189dde70170e6141aa2bd3cbec5644e7553e
SHA51270bb1a7bf085b4373d06db5f1fe8acd011d5fac4d0c3f631b2d2ec7ba355cd05127b21eab290de500c09326674948a8b788eb49eb1ce21d1f58e53c3f22fafe6
-
Filesize
1.8MB
MD5e2de3ad7601e5370da34efa79c574892
SHA192968a543b0b550f8aee3fbd0dcb09d3a1796c2b
SHA256b4e5ea171623572580bb410b04808790db808e3faac36b4da44bfb86daeb3502
SHA5126150a9e7f7b040dbfd10c0bcde6fb45c879877a20dc4c0cb5d26f64cf6a2db0f6b3b7d9d3813a0a200ca5dfe88d778275bb3ab1b7581584dffac4c61fe5bd565