Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

VirtualBox...in.exe

windows7-x64

8

VirtualBox...in.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    62s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 12:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirtualBox-7.0.18-162988-Win.exe

  • Size

    104.6MB

  • MD5

    6a046a57ca3dd222d8bf1410b8172f81

  • SHA1

    49888a74780ac09ab6ec99bbcca5950890e5a227

  • SHA256

    4c83894c00aa9f55f7e0f70807210896ba32e1222d4ff1d0b9487af81f328f36

  • SHA512

    cb19129d62253bde686618cba40449ed05d5435ae11dbbb83ebc9a1b308fc7e9387cb964cb4cf26e91d7e38b9e8b75ebcb5de8039379986bf95cc77456a65a4b

  • SSDEEP

    3145728:aTdp/Gww7IEwmuQYIuSwHn9B4mzL8M6Wfwf:aFw70RQYIfwM6Q7+wf

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.18-162988-Win.exe
    "C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.0.18-162988-Win.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1992
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding C6CF2DC0D2BC83E036D925C681B340BB C
      2⤵
      • Loads dropped DLL
      PID:1284
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:384
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2508

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MSI8400.tmp
      Filesize

      324KB

      MD5

      d045098c42378ebe26f6da17977551ee

      SHA1

      80a93acee96419dd9c44d0d15d7518aea21f782a

      SHA256

      92b89b56400e8d01a813513ef8af685fb23adcaba49d7775853e650266b2f63a

      SHA512

      9e110110c6ec6aa43e64069744901c955ac90253a036b9837d2e0150c5da97cb8f927db4a36e9f289684c3b91724a4d93aa189a3fde9d06d07d62dd4b8c08a35

      Download Submit