Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

Loader.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    19s
  • max time network
    20s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Loader.exe

  • Size

    14.3MB

  • MD5

    52798d5d0ade39da500ac05d8de57b90

  • SHA1

    8926345091c43440778b79238efdeb3f51ff26af

  • SHA256

    5c34e365737b1f0584f54caf50c55b1c30a7c062e8ce5d1ef584f6aa0f4f85ba

  • SHA512

    a9b06437c25de5c0b425764aafff4bb590d58ca44cee21a39edcb58a23db7a6876a427f77166a1d0524a95b7adf9082bc48f2c1838d6c7c1b02964da6e24e9b7

  • SSDEEP

    393216:JhMmSNm/0Ml+u5ytC3bmM6rR78YIQs7MeP7LIjCA:cmSw/0mjyA3bgrHGpPIjh

Score
9/10
evasionexecutionpersistencetrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Drops file in Drivers directory 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4984
      • C:\Windows\system32\sc.exe
        sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
        3⤵
        • Launches sc.exe
        PID:2556
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc start windowsproc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\system32\sc.exe
        sc start windowsproc
        3⤵
        • Launches sc.exe
        PID:1392
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\sc.exe
        sc create windowsproc type=kernel binpath=C:\Windows\System32\drivers\winhb.sys
        3⤵
        • Launches sc.exe
        PID:4420
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4116
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader.exe" MD5
        3⤵
          PID:436
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:4964
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:1064
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C sc start windowsproc
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2004
            • C:\Windows\system32\sc.exe
              sc start windowsproc
              3⤵
              • Launches sc.exe
              PID:1152
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c pause
            2⤵
              PID:4592

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1360-0-0x0000000140000000-0x0000000141FA0000-memory.dmp

            Filesize

            31.6MB

            Download

          • memory/1360-1-0x00007FFDFDF70000-0x00007FFDFDF72000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1360-2-0x0000000140000000-0x0000000141FA0000-memory.dmp

            Filesize

            31.6MB

            Download

          • memory/1360-3-0x0000000140000000-0x0000000141FA0000-memory.dmp

            Filesize

            31.6MB

            Download

          • memory/1360-4-0x0000000140000000-0x0000000141FA0000-memory.dmp

            Filesize

            31.6MB

            Download

          • memory/1360-16-0x0000000140000000-0x0000000141FA0000-memory.dmp

            Filesize

            31.6MB

            Download

          • memory/1360-17-0x0000000140000000-0x0000000141FA0000-memory.dmp

            Filesize

            31.6MB

            Download