Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe
Resource
win7-20241023-en
General
-
Target
b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe
-
Size
3.1MB
-
MD5
450f5d36c348b3da6be54ccf321c7901
-
SHA1
9d2c71e3f3cd475051596f96782ea6378b0acb64
-
SHA256
b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90
-
SHA512
401b3fa84ca126b1b63b7fcc6c1ec66c81e9e60f988696248df6e6af06583f576f31300db750e2cb81a4d36b31036f135f14c221784bf144b11aac3e61ed95c2
-
SSDEEP
49152:S8aDdHEp7c0reuE7+vQSCYrimMFzBprUHh/J3egFW173X1V:PaDep7c0CuEmQ/Yri7BpQDubjlV
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
xworm
5.0
87.120.112.33:8938
rMibaOUiuViiguc4
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://founpiuer.store/api
Signatures
-
Amadey family
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/memory/3048-43-0x0000000000F90000-0x00000000013FC000-memory.dmp family_xworm behavioral1/memory/3048-44-0x0000000000F90000-0x00000000013FC000-memory.dmp family_xworm behavioral1/memory/2796-95-0x00000000060C0000-0x00000000063C5000-memory.dmp family_xworm -
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 7ba304ea54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 7ba304ea54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 7ba304ea54.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 7ba304ea54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 7ba304ea54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 7ba304ea54.exe -
Stealc family
-
Xworm family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7ba304ea54.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ document.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 93a52a25e4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 16aeeeaaca.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion document.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 93a52a25e4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7ba304ea54.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion document.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 16aeeeaaca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 16aeeeaaca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 93a52a25e4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7ba304ea54.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe -
Executes dropped EXE 6 IoCs
pid Process 2796 skotes.exe 3048 document.exe 1540 93a52a25e4.exe 2380 16aeeeaaca.exe 2488 skotes.exe 1708 7ba304ea54.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine document.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 93a52a25e4.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 16aeeeaaca.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine 7ba304ea54.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe -
Loads dropped DLL 8 IoCs
pid Process 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 2796 skotes.exe 2796 skotes.exe 2796 skotes.exe 2796 skotes.exe 2796 skotes.exe 2796 skotes.exe 2796 skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 7ba304ea54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 7ba304ea54.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\7ba304ea54.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004752001\\7ba304ea54.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" document.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\93a52a25e4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004749001\\93a52a25e4.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\16aeeeaaca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004750001\\16aeeeaaca.exe" skotes.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 2796 skotes.exe 3048 document.exe 1540 93a52a25e4.exe 2380 16aeeeaaca.exe 2488 skotes.exe 1708 7ba304ea54.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2796 set thread context of 2488 2796 skotes.exe 37 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93a52a25e4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16aeeeaaca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ba304ea54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language document.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3048 document.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 2796 skotes.exe 3048 document.exe 1540 93a52a25e4.exe 3048 document.exe 2380 16aeeeaaca.exe 2488 skotes.exe 1708 7ba304ea54.exe 1708 7ba304ea54.exe 1708 7ba304ea54.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3048 document.exe Token: SeDebugPrivilege 1708 7ba304ea54.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3048 document.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2796 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 30 PID 2224 wrote to memory of 2796 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 30 PID 2224 wrote to memory of 2796 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 30 PID 2224 wrote to memory of 2796 2224 b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe 30 PID 2796 wrote to memory of 3048 2796 skotes.exe 33 PID 2796 wrote to memory of 3048 2796 skotes.exe 33 PID 2796 wrote to memory of 3048 2796 skotes.exe 33 PID 2796 wrote to memory of 3048 2796 skotes.exe 33 PID 2796 wrote to memory of 1540 2796 skotes.exe 34 PID 2796 wrote to memory of 1540 2796 skotes.exe 34 PID 2796 wrote to memory of 1540 2796 skotes.exe 34 PID 2796 wrote to memory of 1540 2796 skotes.exe 34 PID 2796 wrote to memory of 2380 2796 skotes.exe 36 PID 2796 wrote to memory of 2380 2796 skotes.exe 36 PID 2796 wrote to memory of 2380 2796 skotes.exe 36 PID 2796 wrote to memory of 2380 2796 skotes.exe 36 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 2488 2796 skotes.exe 37 PID 2796 wrote to memory of 1708 2796 skotes.exe 38 PID 2796 wrote to memory of 1708 2796 skotes.exe 38 PID 2796 wrote to memory of 1708 2796 skotes.exe 38 PID 2796 wrote to memory of 1708 2796 skotes.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe"C:\Users\Admin\AppData\Local\Temp\b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1004732001\document.exe"C:\Users\Admin\AppData\Local\Temp\1004732001\document.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
C:\Users\Admin\AppData\Local\Temp\1004749001\93a52a25e4.exe"C:\Users\Admin\AppData\Local\Temp\1004749001\93a52a25e4.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\1004750001\16aeeeaaca.exe"C:\Users\Admin\AppData\Local\Temp\1004750001\16aeeeaaca.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\1004752001\7ba304ea54.exe"C:\Users\Admin\AppData\Local\Temp\1004752001\7ba304ea54.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD51aa5cd181621c7e3f04bcfdf3b31c263
SHA1694da2562c80da15128d4fdd305219f97c9fb970
SHA256b738ac1ae6debdb89df7e074577c1f0c12dfb80fa6cb708e08f168b744386a6b
SHA5121e4f1d3b81e47f2beb64eca5e913750bafd8c2451afda104e6c8562e4d4fcccdf2a27eb39d2ae17ce7fcab86defec98bc4fa986f6f39b793d2890e1358250c28
-
Filesize
3.0MB
MD5dceb05bdd62c6c55ab493ccd4d6ca445
SHA1236ca65f1dbfdc4a06140af7871cd4aa8d2ba1d1
SHA256e293319a6bb1415044af45cf66026b591dc5f72c8e83c39e35af8c5e6579c7e5
SHA51259d9ea396546a2b8ca2de08a791f7954c1286837c6effa24ec858f79af0464c4e20136bdc7d7acb7655e2403e1377fe3615b9d52bc75bc9bb8161007922783c9
-
Filesize
2.1MB
MD518c1fe0a3db9ac8cf9bae44f3d261a2c
SHA1cd3a1f06db593e00e03a43bf2ba1732897c94721
SHA256d33bf5ccd141c26d9e218fb573b078cdcd54eb890d2a32306a0eea649750aad8
SHA51260f9cc29f296a828828d278512128ceadc90618cc204774539037293c628018c5d1dfb9d5ced3819209c644116a9cf1b4bb0f7b5b680d45aa779c42fb5010735
-
Filesize
2.7MB
MD50388e2b7bda529ad2e2c828e347c50ff
SHA11810d53c0c9a63e27bd0d41b1dfd0ad92910e8e0
SHA25652e24f63eb5333c50be7274f75f8bd2672abbebacded171bb597f7a941f80c3a
SHA512d7120812ac04c355cafee1daad4d0599ce181f6f29017ba61654ba22295449e5fb1cadd19b175a6cb57045e3e4832cdb6056f0ae5788bd1534e6bc13275bb84b
-
Filesize
3.1MB
MD5450f5d36c348b3da6be54ccf321c7901
SHA19d2c71e3f3cd475051596f96782ea6378b0acb64
SHA256b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90
SHA512401b3fa84ca126b1b63b7fcc6c1ec66c81e9e60f988696248df6e6af06583f576f31300db750e2cb81a4d36b31036f135f14c221784bf144b11aac3e61ed95c2