Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20241010-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
9b8db0a71bea0503b72502f6b7e9cc55
-
SHA1
2ea420bde7b1d202670292af13649b840e02eed8
-
SHA256
fabcaffe12bb450540c927b2579527ccee45730225ecd1ef7bc8b2d64ec1aecc
-
SHA512
d2a509269644c94b10e3bd4990810523747b113ec0d56a0d22b61402cf9870b4a6bde3f03943548e7ef228e77af07a735c5f556e367f62908a3b545d96d6754c
-
SSDEEP
49152:MJIHxJWafHTLPggPxcREfAOXxXLP6FxgMRbp:pHxJpHTDZcREvXF6FyE
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 1 IoCs
pid Process 2896 skotes.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine file.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine skotes.exe -
Loads dropped DLL 1 IoCs
pid Process 3032 file.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3032 file.exe 2896 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3032 file.exe 2896 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 file.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2896 3032 file.exe 30 PID 3032 wrote to memory of 2896 3032 file.exe 30 PID 3032 wrote to memory of 2896 3032 file.exe 30 PID 3032 wrote to memory of 2896 3032 file.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59b8db0a71bea0503b72502f6b7e9cc55
SHA12ea420bde7b1d202670292af13649b840e02eed8
SHA256fabcaffe12bb450540c927b2579527ccee45730225ecd1ef7bc8b2d64ec1aecc
SHA512d2a509269644c94b10e3bd4990810523747b113ec0d56a0d22b61402cf9870b4a6bde3f03943548e7ef228e77af07a735c5f556e367f62908a3b545d96d6754c