Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 03:48
Behavioral task
behavioral1
Sample
weave.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
weave.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
weave.exe
Resource
win10v2004-20240802-en
General
-
Target
weave.exe
-
Size
3.1MB
-
MD5
a1b6a96519aaa206ac30aad7088e3242
-
SHA1
04bf79e8c40f4cda2a4b345ef1467e159bdb0fae
-
SHA256
7dd55d5932f394089ef875e89fb0c92edfa507ce096715e4928e08a0001079cd
-
SHA512
430fa2394e0a338f0fdb9efd6ce14ccab6ed4d0367e2ac58becef37a0f78b9d0675a33f6e7234fe76df29b39e7a16cfc097c89b3c78d5224ae669d928b11e086
-
SSDEEP
98304:dV5Cx40FHvu+ST0sI0aT7qrloC3Y2dSB6rWo4Bud5:FM40FGtAjrT7kloC3Y24ri
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ weave.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1096 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion weave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion weave.exe -
resource yara_rule behavioral1/memory/2756-0-0x000000013F840000-0x00000001400E2000-memory.dmp themida behavioral1/memory/2756-13-0x000000013F840000-0x00000001400E2000-memory.dmp themida behavioral1/memory/2756-14-0x000000013F840000-0x00000001400E2000-memory.dmp themida behavioral1/memory/2756-18-0x000000013F840000-0x00000001400E2000-memory.dmp themida behavioral1/memory/2756-25-0x000000013F840000-0x00000001400E2000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA weave.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2756 weave.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1096 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2500 2756 weave.exe 32 PID 2756 wrote to memory of 2500 2756 weave.exe 32 PID 2756 wrote to memory of 2500 2756 weave.exe 32 PID 2500 wrote to memory of 1096 2500 cmd.exe 33 PID 2500 wrote to memory of 1096 2500 cmd.exe 33 PID 2500 wrote to memory of 1096 2500 cmd.exe 33 PID 2756 wrote to memory of 2704 2756 weave.exe 34 PID 2756 wrote to memory of 2704 2756 weave.exe 34 PID 2756 wrote to memory of 2704 2756 weave.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\weave.exe"C:\Users\Admin\AppData\Local\Temp\weave.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\windows\system32'" > NUL 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\windows\system32'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2704
-