Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 15:01
General
-
Target
db97570a01873908d9790a206d1eb5f0N.exe
-
Size
1.9MB
-
MD5
db97570a01873908d9790a206d1eb5f0
-
SHA1
b77105f5ebc5848a08262e4f528405a54fe66532
-
SHA256
f151a4e141442d10d6fe624521a29c03f1ee6142c6feff3c449c3bfccbf04596
-
SHA512
126e2467c13c95988f90e6c44c4ad5fbeaca41fb33821fd9d0178b316c14e73647874cbd448e3c9eed4a9f4eca1c72d7283ab3615f5518da3031f0c7ccca776c
-
SSDEEP
49152:ISlNHydXboE+2pKWTvP6p9kB/GS0fsXCFK:ISjydNCYn0+x
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db97570a01873908d9790a206d1eb5f0N.exe"C:\Users\Admin\AppData\Local\Temp\db97570a01873908d9790a206d1eb5f0N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5a0d443199d0262c72f8eab27a61ef1ec
SHA1b5969cbf4ab2da3b6b6621b20c8e9f50d213c4c3
SHA25612728703314bc2d8a9407d21ca02a2ea927310a19cc477e9a3cfb1be66bff629
SHA512489123b14d882b2eba6fd72e097f2b54974874010e167ad3b25a61024268c996d666b7f230b2dee21c1ceb4103a06fc78f04bb6568cd029b3baac6e263b25eec
-
Filesize
1.9MB
MD503b1cacdc61f5199539fda7188ce6f14
SHA1bf24ebc1ab3869bd00f8dd9914b6ea0d9b353a4a
SHA2566f1b5ce58e92221d89ab178fe3eabe75b120aba53050fc0f73a8233f81819c11
SHA5121b4a0a412d40d2a89b40817f4cff5b6f2cb28b49ce2e80f5aff5709f2fd09734b12022a7710418109c5138c9f746c48de2e27067480626ea0f715c6e8cc34b4c
-
Filesize
1.9MB
MD59ca59a443e58e2a2a9ae88fcac5d7d7e
SHA1bc8601f217d3e5985e3de5427701d7c47f7568f5
SHA25672df9b68649e95d2b1c03afe2b1361ea7eece93c7e4e5859d9b00cfc6714d812
SHA512547bd285bd244ce5fa50a93d02f1600241afb37b3325ef0a1d691a080f8c1193e7b2f0ecc05ca5ac45c0d4e23fd58ba933e23bf5b32c90bfcb99e11d9e239b00
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB