Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe
Resource
win7-20241010-en
General
-
Target
d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe
-
Size
1.8MB
-
MD5
4264eccf5968410db0afcf14351fc8e0
-
SHA1
b0dcc6ccd68005534f9a7172c5d9e1d510d42de3
-
SHA256
d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49ed
-
SHA512
2aa4dae701bd619e7d2befe3365faf671dfd1c458510603e5742baccc21ebb600f67d71e3181f76333401b5c581150b1420e9a7c9ead54ad8ad8f0e2fded7b0c
-
SSDEEP
49152:BOvzK7kxWcm+/SOsV1z5ujABwJmPZmWQMaROW8ywP:By+7cW6+kABwTXOd
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://navygenerayk.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 451fc59c12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 451fc59c12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 451fc59c12.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 451fc59c12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 451fc59c12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 451fc59c12.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 451fc59c12.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1c7a994fc7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 23943cd4d1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 451fc59c12.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1c7a994fc7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1c7a994fc7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 23943cd4d1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 23943cd4d1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 451fc59c12.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe -
Executes dropped EXE 5 IoCs
pid Process 2860 skotes.exe 2344 1c7a994fc7.exe 2652 23943cd4d1.exe 1604 skotes.exe 2520 451fc59c12.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 1c7a994fc7.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 23943cd4d1.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine 451fc59c12.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine skotes.exe -
Loads dropped DLL 8 IoCs
pid Process 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 2860 skotes.exe 2860 skotes.exe 2860 skotes.exe 2860 skotes.exe 2860 skotes.exe 2860 skotes.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 451fc59c12.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 451fc59c12.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\1c7a994fc7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004972001\\1c7a994fc7.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\23943cd4d1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004973001\\23943cd4d1.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\451fc59c12.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004975001\\451fc59c12.exe" skotes.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 2860 skotes.exe 2344 1c7a994fc7.exe 2652 23943cd4d1.exe 1604 skotes.exe 2520 451fc59c12.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2860 set thread context of 1604 2860 skotes.exe 35 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451fc59c12.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c7a994fc7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23943cd4d1.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 2860 skotes.exe 2344 1c7a994fc7.exe 2652 23943cd4d1.exe 1604 skotes.exe 2520 451fc59c12.exe 2520 451fc59c12.exe 2520 451fc59c12.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2520 451fc59c12.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2860 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 31 PID 2992 wrote to memory of 2860 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 31 PID 2992 wrote to memory of 2860 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 31 PID 2992 wrote to memory of 2860 2992 d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe 31 PID 2860 wrote to memory of 2344 2860 skotes.exe 33 PID 2860 wrote to memory of 2344 2860 skotes.exe 33 PID 2860 wrote to memory of 2344 2860 skotes.exe 33 PID 2860 wrote to memory of 2344 2860 skotes.exe 33 PID 2860 wrote to memory of 2652 2860 skotes.exe 34 PID 2860 wrote to memory of 2652 2860 skotes.exe 34 PID 2860 wrote to memory of 2652 2860 skotes.exe 34 PID 2860 wrote to memory of 2652 2860 skotes.exe 34 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 1604 2860 skotes.exe 35 PID 2860 wrote to memory of 2520 2860 skotes.exe 36 PID 2860 wrote to memory of 2520 2860 skotes.exe 36 PID 2860 wrote to memory of 2520 2860 skotes.exe 36 PID 2860 wrote to memory of 2520 2860 skotes.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe"C:\Users\Admin\AppData\Local\Temp\d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49edN.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1004972001\1c7a994fc7.exe"C:\Users\Admin\AppData\Local\Temp\1004972001\1c7a994fc7.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\1004973001\23943cd4d1.exe"C:\Users\Admin\AppData\Local\Temp\1004973001\23943cd4d1.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\1004975001\451fc59c12.exe"C:\Users\Admin\AppData\Local\Temp\1004975001\451fc59c12.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5bb610f3b68a61a23e8d71c8fad693f38
SHA1b077edd1521904673b7dd7f01d45e7aa3cbce4fb
SHA2561ad85e7a7ae029b5d4003420b6912a51fcefc95f6b7f64fabc2783e10286857a
SHA5129353f34e693fc2bbcf7da5ce3f9d3382262786ccaf763a00b3a874949f6e17beca912a61f144dc0fb6e7a2794e53721d3631c84b5a4afccfd679cb0974d9c914
-
Filesize
2.1MB
MD5f058a72e4dbe19f8b8ffb8785c2820d2
SHA1440c44260ad8564a776ec1292adc4577906009fe
SHA2566a443c0ac67ec4aff6acb6319cfc04d68bf0f861ac0424dec70a6bb8a27975cb
SHA512bb2068d16c5f8a02aa2df1d51b491fb48de7a47cf74bb69e1ea20feb5b33f529d8e2d0b36844fa6ce961aa3c6337c057af7533153209cf26b4db6b7cd30d23ea
-
Filesize
2.7MB
MD58f83afca9c2c5f691e0d72198fc243eb
SHA1fb78a4d64c193fdf5a8da774bc217b0d53f4e567
SHA256eca345932d6d86344eeff06cb9b3d60131d23f48f59a5dd73fec57734bba3e01
SHA51215c690eedd848bf377b0c2a2dddaea5f90e1fae50ab20ed4d2fd61c7d57d1b070df5f1d5b6258f89aabbda2fd0661e2861bff273474c9aa4fa68fcc08a7203bc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1.8MB
MD54264eccf5968410db0afcf14351fc8e0
SHA1b0dcc6ccd68005534f9a7172c5d9e1d510d42de3
SHA256d4417b23f8728ae97d162dcb9916ad36aac089a2dd684936884f013bd50f49ed
SHA5122aa4dae701bd619e7d2befe3365faf671dfd1c458510603e5742baccc21ebb600f67d71e3181f76333401b5c581150b1420e9a7c9ead54ad8ad8f0e2fded7b0c