Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 03:39

General

  • Target

    b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe

  • Size

    3.1MB

  • MD5

    450f5d36c348b3da6be54ccf321c7901

  • SHA1

    9d2c71e3f3cd475051596f96782ea6378b0acb64

  • SHA256

    b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90

  • SHA512

    401b3fa84ca126b1b63b7fcc6c1ec66c81e9e60f988696248df6e6af06583f576f31300db750e2cb81a4d36b31036f135f14c221784bf144b11aac3e61ed95c2

  • SSDEEP

    49152:S8aDdHEp7c0reuE7+vQSCYrimMFzBprUHh/J3egFW173X1V:PaDep7c0CuEmQ/Yri7BpQDubjlV

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

Version

5.0

C2

87.120.112.33:8938

Mutex

rMibaOUiuViiguc4

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

aes.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Detect Xworm Payload 3 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe
    "C:\Users\Admin\AppData\Local\Temp\b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Users\Admin\AppData\Local\Temp\1004732001\document.exe
        "C:\Users\Admin\AppData\Local\Temp\1004732001\document.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3048
      • C:\Users\Admin\AppData\Local\Temp\1004749001\93a52a25e4.exe
        "C:\Users\Admin\AppData\Local\Temp\1004749001\93a52a25e4.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1540
      • C:\Users\Admin\AppData\Local\Temp\1004750001\16aeeeaaca.exe
        "C:\Users\Admin\AppData\Local\Temp\1004750001\16aeeeaaca.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2380
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2488
      • C:\Users\Admin\AppData\Local\Temp\1004752001\7ba304ea54.exe
        "C:\Users\Admin\AppData\Local\Temp\1004752001\7ba304ea54.exe"
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Windows security modification
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1004732001\document.exe

    Filesize

    1.7MB

    MD5

    1aa5cd181621c7e3f04bcfdf3b31c263

    SHA1

    694da2562c80da15128d4fdd305219f97c9fb970

    SHA256

    b738ac1ae6debdb89df7e074577c1f0c12dfb80fa6cb708e08f168b744386a6b

    SHA512

    1e4f1d3b81e47f2beb64eca5e913750bafd8c2451afda104e6c8562e4d4fcccdf2a27eb39d2ae17ce7fcab86defec98bc4fa986f6f39b793d2890e1358250c28

  • C:\Users\Admin\AppData\Local\Temp\1004749001\93a52a25e4.exe

    Filesize

    3.0MB

    MD5

    dceb05bdd62c6c55ab493ccd4d6ca445

    SHA1

    236ca65f1dbfdc4a06140af7871cd4aa8d2ba1d1

    SHA256

    e293319a6bb1415044af45cf66026b591dc5f72c8e83c39e35af8c5e6579c7e5

    SHA512

    59d9ea396546a2b8ca2de08a791f7954c1286837c6effa24ec858f79af0464c4e20136bdc7d7acb7655e2403e1377fe3615b9d52bc75bc9bb8161007922783c9

  • C:\Users\Admin\AppData\Local\Temp\1004750001\16aeeeaaca.exe

    Filesize

    2.1MB

    MD5

    18c1fe0a3db9ac8cf9bae44f3d261a2c

    SHA1

    cd3a1f06db593e00e03a43bf2ba1732897c94721

    SHA256

    d33bf5ccd141c26d9e218fb573b078cdcd54eb890d2a32306a0eea649750aad8

    SHA512

    60f9cc29f296a828828d278512128ceadc90618cc204774539037293c628018c5d1dfb9d5ced3819209c644116a9cf1b4bb0f7b5b680d45aa779c42fb5010735

  • C:\Users\Admin\AppData\Local\Temp\1004752001\7ba304ea54.exe

    Filesize

    2.7MB

    MD5

    0388e2b7bda529ad2e2c828e347c50ff

    SHA1

    1810d53c0c9a63e27bd0d41b1dfd0ad92910e8e0

    SHA256

    52e24f63eb5333c50be7274f75f8bd2672abbebacded171bb597f7a941f80c3a

    SHA512

    d7120812ac04c355cafee1daad4d0599ce181f6f29017ba61654ba22295449e5fb1cadd19b175a6cb57045e3e4832cdb6056f0ae5788bd1534e6bc13275bb84b

  • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

    Filesize

    3.1MB

    MD5

    450f5d36c348b3da6be54ccf321c7901

    SHA1

    9d2c71e3f3cd475051596f96782ea6378b0acb64

    SHA256

    b6f12e1681c93ba7210b921f2c7b8ca2a0ef662b0545f60821e1ef7ccc13cd90

    SHA512

    401b3fa84ca126b1b63b7fcc6c1ec66c81e9e60f988696248df6e6af06583f576f31300db750e2cb81a4d36b31036f135f14c221784bf144b11aac3e61ed95c2

  • memory/1540-67-0x0000000000DA0000-0x00000000010A5000-memory.dmp

    Filesize

    3.0MB

  • memory/1540-64-0x0000000000DA0000-0x00000000010A5000-memory.dmp

    Filesize

    3.0MB

  • memory/1708-187-0x0000000000040000-0x00000000002FE000-memory.dmp

    Filesize

    2.7MB

  • memory/1708-188-0x0000000000040000-0x00000000002FE000-memory.dmp

    Filesize

    2.7MB

  • memory/1708-197-0x0000000000040000-0x00000000002FE000-memory.dmp

    Filesize

    2.7MB

  • memory/1708-195-0x0000000000040000-0x00000000002FE000-memory.dmp

    Filesize

    2.7MB

  • memory/1708-189-0x0000000000040000-0x00000000002FE000-memory.dmp

    Filesize

    2.7MB

  • memory/2224-3-0x00000000011C0000-0x00000000014D9000-memory.dmp

    Filesize

    3.1MB

  • memory/2224-4-0x00000000011C0000-0x00000000014D9000-memory.dmp

    Filesize

    3.1MB

  • memory/2224-17-0x00000000011C1000-0x0000000001229000-memory.dmp

    Filesize

    416KB

  • memory/2224-2-0x00000000011C1000-0x0000000001229000-memory.dmp

    Filesize

    416KB

  • memory/2224-0-0x00000000011C0000-0x00000000014D9000-memory.dmp

    Filesize

    3.1MB

  • memory/2224-1-0x0000000077120000-0x0000000077122000-memory.dmp

    Filesize

    8KB

  • memory/2224-15-0x0000000006D10000-0x0000000007029000-memory.dmp

    Filesize

    3.1MB

  • memory/2224-14-0x00000000011C0000-0x00000000014D9000-memory.dmp

    Filesize

    3.1MB

  • memory/2380-89-0x0000000001310000-0x0000000001A4D000-memory.dmp

    Filesize

    7.2MB

  • memory/2380-88-0x0000000001310000-0x0000000001A4D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-138-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-123-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-145-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-141-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-142-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-143-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-144-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-140-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-130-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-131-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-132-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-133-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-134-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-135-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-137-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-139-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-96-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-98-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-100-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-102-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-136-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-106-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-108-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-110-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2488-111-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-114-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2488-113-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-115-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-118-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-122-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-126-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-125-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-124-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-128-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-121-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-120-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-119-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-117-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-116-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-127-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2488-129-0x0000000000400000-0x0000000000B3D000-memory.dmp

    Filesize

    7.2MB

  • memory/2796-42-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-87-0x00000000066E0000-0x0000000006E1D000-memory.dmp

    Filesize

    7.2MB

  • memory/2796-94-0x00000000060C0000-0x00000000063D9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-38-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-95-0x00000000060C0000-0x00000000063C5000-memory.dmp

    Filesize

    3.0MB

  • memory/2796-37-0x00000000011D1000-0x0000000001239000-memory.dmp

    Filesize

    416KB

  • memory/2796-45-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-18-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-68-0x00000000066E0000-0x0000000006B4C000-memory.dmp

    Filesize

    4.4MB

  • memory/2796-40-0x00000000066E0000-0x0000000006B4C000-memory.dmp

    Filesize

    4.4MB

  • memory/2796-104-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-190-0x00000000060C0000-0x00000000063D9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-85-0x00000000066E0000-0x0000000006E1D000-memory.dmp

    Filesize

    7.2MB

  • memory/2796-19-0x00000000011D1000-0x0000000001239000-memory.dmp

    Filesize

    416KB

  • memory/2796-61-0x00000000060C0000-0x00000000063C5000-memory.dmp

    Filesize

    3.0MB

  • memory/2796-62-0x00000000060C0000-0x00000000063C5000-memory.dmp

    Filesize

    3.0MB

  • memory/2796-193-0x00000000060C0000-0x000000000637E000-memory.dmp

    Filesize

    2.7MB

  • memory/2796-24-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-23-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-186-0x00000000060C0000-0x000000000637E000-memory.dmp

    Filesize

    2.7MB

  • memory/2796-184-0x00000000066E0000-0x0000000006E1D000-memory.dmp

    Filesize

    7.2MB

  • memory/2796-22-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/2796-20-0x00000000011D0000-0x00000000014E9000-memory.dmp

    Filesize

    3.1MB

  • memory/3048-84-0x0000000000F90000-0x00000000013FC000-memory.dmp

    Filesize

    4.4MB

  • memory/3048-44-0x0000000000F90000-0x00000000013FC000-memory.dmp

    Filesize

    4.4MB

  • memory/3048-43-0x0000000000F90000-0x00000000013FC000-memory.dmp

    Filesize

    4.4MB

  • memory/3048-41-0x0000000000F90000-0x00000000013FC000-memory.dmp

    Filesize

    4.4MB