Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/07/2024, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
Resource
win10v2004-20240704-en
General
-
Target
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe
-
Size
2.4MB
-
MD5
372c9047c2f9bc0241a64b506054fa0a
-
SHA1
a3dca1dc8b61381c1fca9f6951352aa5f6a2403f
-
SHA256
3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22
-
SHA512
1ddc4dcc4e77ec0c147afe1606f50a989ae8cc8ecae67cc5fb122cf985b2aec84c4968fc2075ffeb0f666d1ca0669acef855e8e647e681a31dd1d5d70a0f13fa
-
SSDEEP
49152:vUlvV1PH2uIE3Hnj3d6Swz5+8gPNwvHTnUzHuC/yTkRT2VxLvgs:cp3P2xET3d6SwFUwvzCzTELYs
Malware Config
Extracted
stealc
Nice
http://85.28.47.30
-
url_path
/920475a59bac849d.php
Extracted
amadey
4.30
4dd39d
http://77.91.77.82
-
install_dir
ad40971b6b
-
install_file
explorti.exe
-
strings_key
a434973ad22def7137dbb5e059b7081e
-
url_paths
/Hun4Ko/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ KJDGDBFBGI.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion KJDGDBFBGI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion KJDGDBFBGI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Executes dropped EXE 5 IoCs
pid Process 2436 KJDGDBFBGI.exe 1152 explorti.exe 3768 explorti.exe 1504 explorti.exe 4216 explorti.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000\Software\Wine KJDGDBFBGI.exe Key opened \REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000\Software\Wine explorti.exe -
Loads dropped DLL 2 IoCs
pid Process 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 2436 KJDGDBFBGI.exe 1152 explorti.exe 3768 explorti.exe 1504 explorti.exe 4216 explorti.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\explorti.job KJDGDBFBGI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 2436 KJDGDBFBGI.exe 2436 KJDGDBFBGI.exe 1152 explorti.exe 1152 explorti.exe 3768 explorti.exe 3768 explorti.exe 1504 explorti.exe 1504 explorti.exe 4216 explorti.exe 4216 explorti.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 KJDGDBFBGI.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 2828 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3776 wrote to memory of 2052 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 81 PID 3776 wrote to memory of 2052 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 81 PID 3776 wrote to memory of 2052 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 81 PID 3776 wrote to memory of 2828 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 82 PID 3776 wrote to memory of 2828 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 82 PID 3776 wrote to memory of 2828 3776 3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe 82 PID 2052 wrote to memory of 2436 2052 cmd.exe 85 PID 2052 wrote to memory of 2436 2052 cmd.exe 85 PID 2052 wrote to memory of 2436 2052 cmd.exe 85 PID 2436 wrote to memory of 1152 2436 KJDGDBFBGI.exe 86 PID 2436 wrote to memory of 1152 2436 KJDGDBFBGI.exe 86 PID 2436 wrote to memory of 1152 2436 KJDGDBFBGI.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe"C:\Users\Admin\AppData\Local\Temp\3781240686f18f44cfb8397dfe462c164a00f0c4b08177b468129bc8c41a1f22.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KJDGDBFBGI.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\KJDGDBFBGI.exe"C:\Users\Admin\AppData\Local\Temp\KJDGDBFBGI.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCBAECGIEB.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3768
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1504
-
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exeC:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
1.8MB
MD561ce43973f7cce2b561705e2c075d840
SHA13e4cc6785d2c26902699c3c800d40375b6ef085b
SHA256c59694f951c18c5b6af416b45e4c94049882904eced113e2415988fa8e241f11
SHA512bf68c402f73551fe3a3c476d392572b1fba61f52a1e3e68c83c0ba675cdbc77f127078481c7829695c1209afafb8eb9b2de909e252300a2288f96d310b25c9fe