Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe
Resource
win7-20240903-en
General
-
Target
3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe
-
Size
3.1MB
-
MD5
8b8430033bc22c639de35454428b6726
-
SHA1
08c2adfefff4ae6430d1a8e314810f2441e8481d
-
SHA256
3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627
-
SHA512
dd658aa1eb121ea3745ffa64a95199b74d65955e5f992fbc834898c43455430957f7e1e29ba73a71a7a9182687115ddb01df15a3cc029e15635cd2879c3b8218
-
SSDEEP
49152:kK4JjD4W1BHVijOZUgw7aKRmvKuhXA7uvGxC33Abcv:kKWHVijOZDw7aK8hw6vGxfO
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Extracted
lumma
https://navygenerayk.store/api
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a8b0c06173.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a8b0c06173.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a8b0c06173.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a8b0c06173.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a8b0c06173.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a8b0c06173.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 420cc8eaf5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ccbd023517.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a8b0c06173.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 420cc8eaf5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ccbd023517.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a8b0c06173.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a8b0c06173.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 420cc8eaf5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ccbd023517.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 5 IoCs
pid Process 2980 skotes.exe 2936 420cc8eaf5.exe 848 ccbd023517.exe 1536 skotes.exe 2724 a8b0c06173.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine 420cc8eaf5.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine ccbd023517.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine a8b0c06173.exe -
Loads dropped DLL 7 IoCs
pid Process 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 2980 skotes.exe 2980 skotes.exe 2980 skotes.exe 2980 skotes.exe 2980 skotes.exe 2980 skotes.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features a8b0c06173.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a8b0c06173.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\420cc8eaf5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004972001\\420cc8eaf5.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ccbd023517.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004973001\\ccbd023517.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\a8b0c06173.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1004975001\\a8b0c06173.exe" skotes.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 2980 skotes.exe 2936 420cc8eaf5.exe 848 ccbd023517.exe 1536 skotes.exe 2724 a8b0c06173.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2980 set thread context of 1536 2980 skotes.exe 34 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8b0c06173.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420cc8eaf5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccbd023517.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 2980 skotes.exe 2936 420cc8eaf5.exe 848 ccbd023517.exe 1536 skotes.exe 2724 a8b0c06173.exe 2724 a8b0c06173.exe 2724 a8b0c06173.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2724 a8b0c06173.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2980 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 30 PID 2132 wrote to memory of 2980 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 30 PID 2132 wrote to memory of 2980 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 30 PID 2132 wrote to memory of 2980 2132 3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe 30 PID 2980 wrote to memory of 2936 2980 skotes.exe 32 PID 2980 wrote to memory of 2936 2980 skotes.exe 32 PID 2980 wrote to memory of 2936 2980 skotes.exe 32 PID 2980 wrote to memory of 2936 2980 skotes.exe 32 PID 2980 wrote to memory of 848 2980 skotes.exe 33 PID 2980 wrote to memory of 848 2980 skotes.exe 33 PID 2980 wrote to memory of 848 2980 skotes.exe 33 PID 2980 wrote to memory of 848 2980 skotes.exe 33 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 1536 2980 skotes.exe 34 PID 2980 wrote to memory of 2724 2980 skotes.exe 35 PID 2980 wrote to memory of 2724 2980 skotes.exe 35 PID 2980 wrote to memory of 2724 2980 skotes.exe 35 PID 2980 wrote to memory of 2724 2980 skotes.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe"C:\Users\Admin\AppData\Local\Temp\3391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1004972001\420cc8eaf5.exe"C:\Users\Admin\AppData\Local\Temp\1004972001\420cc8eaf5.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\1004973001\ccbd023517.exe"C:\Users\Admin\AppData\Local\Temp\1004973001\ccbd023517.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\1004975001\a8b0c06173.exe"C:\Users\Admin\AppData\Local\Temp\1004975001\a8b0c06173.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5bb610f3b68a61a23e8d71c8fad693f38
SHA1b077edd1521904673b7dd7f01d45e7aa3cbce4fb
SHA2561ad85e7a7ae029b5d4003420b6912a51fcefc95f6b7f64fabc2783e10286857a
SHA5129353f34e693fc2bbcf7da5ce3f9d3382262786ccaf763a00b3a874949f6e17beca912a61f144dc0fb6e7a2794e53721d3631c84b5a4afccfd679cb0974d9c914
-
Filesize
2.1MB
MD5f058a72e4dbe19f8b8ffb8785c2820d2
SHA1440c44260ad8564a776ec1292adc4577906009fe
SHA2566a443c0ac67ec4aff6acb6319cfc04d68bf0f861ac0424dec70a6bb8a27975cb
SHA512bb2068d16c5f8a02aa2df1d51b491fb48de7a47cf74bb69e1ea20feb5b33f529d8e2d0b36844fa6ce961aa3c6337c057af7533153209cf26b4db6b7cd30d23ea
-
Filesize
2.7MB
MD58f83afca9c2c5f691e0d72198fc243eb
SHA1fb78a4d64c193fdf5a8da774bc217b0d53f4e567
SHA256eca345932d6d86344eeff06cb9b3d60131d23f48f59a5dd73fec57734bba3e01
SHA51215c690eedd848bf377b0c2a2dddaea5f90e1fae50ab20ed4d2fd61c7d57d1b070df5f1d5b6258f89aabbda2fd0661e2861bff273474c9aa4fa68fcc08a7203bc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
3.1MB
MD58b8430033bc22c639de35454428b6726
SHA108c2adfefff4ae6430d1a8e314810f2441e8481d
SHA2563391ee2bdfbcd96a89f52a9b45d3615923b6214e4f1019b3e5a0f479d8d12627
SHA512dd658aa1eb121ea3745ffa64a95199b74d65955e5f992fbc834898c43455430957f7e1e29ba73a71a7a9182687115ddb01df15a3cc029e15635cd2879c3b8218