Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe
Resource
win7-20240903-en
General
-
Target
4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe
-
Size
1.8MB
-
MD5
9e50d297946c37d3a1d1da00762d4e48
-
SHA1
f7c1f6d79350183902532f4f74c55110099418b7
-
SHA256
4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062
-
SHA512
e6a29fabdf67f7080513a2ef677e324f8c94817c9504ab020a034a9fa6ae12c7935963be490842ace30b458ff8d51a9229887ff3a8bdca1b80472cc80925f114
-
SSDEEP
49152:o9I0TNAwTWApTxMORD1vKsBFsAjthoLj:x0pAoZSmFsAjtW
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aaa7af910c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection aaa7af910c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aaa7af910c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aaa7af910c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aaa7af910c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aaa7af910c.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b311d39bb2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ aaa7af910c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion aaa7af910c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion aaa7af910c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b311d39bb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b311d39bb2.exe -
Executes dropped EXE 3 IoCs
pid Process 2204 axplong.exe 1068 b311d39bb2.exe 1636 aaa7af910c.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine b311d39bb2.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine aaa7af910c.exe -
Loads dropped DLL 6 IoCs
pid Process 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 2204 axplong.exe 2204 axplong.exe 2204 axplong.exe 2204 axplong.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aaa7af910c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features aaa7af910c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\b311d39bb2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006208001\\b311d39bb2.exe" axplong.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaa7af910c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006209001\\aaa7af910c.exe" axplong.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 2204 axplong.exe 1068 b311d39bb2.exe 1636 aaa7af910c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\axplong.job 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b311d39bb2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaa7af910c.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 2204 axplong.exe 1068 b311d39bb2.exe 1636 aaa7af910c.exe 1636 aaa7af910c.exe 1636 aaa7af910c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1636 aaa7af910c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2204 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 30 PID 2100 wrote to memory of 2204 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 30 PID 2100 wrote to memory of 2204 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 30 PID 2100 wrote to memory of 2204 2100 4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe 30 PID 2204 wrote to memory of 1068 2204 axplong.exe 32 PID 2204 wrote to memory of 1068 2204 axplong.exe 32 PID 2204 wrote to memory of 1068 2204 axplong.exe 32 PID 2204 wrote to memory of 1068 2204 axplong.exe 32 PID 2204 wrote to memory of 1636 2204 axplong.exe 34 PID 2204 wrote to memory of 1636 2204 axplong.exe 34 PID 2204 wrote to memory of 1636 2204 axplong.exe 34 PID 2204 wrote to memory of 1636 2204 axplong.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe"C:\Users\Admin\AppData\Local\Temp\4578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1006208001\b311d39bb2.exe"C:\Users\Admin\AppData\Local\Temp\1006208001\b311d39bb2.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\1006209001\aaa7af910c.exe"C:\Users\Admin\AppData\Local\Temp\1006209001\aaa7af910c.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD598c5024a596c5c548d36bc33ae113a73
SHA1b30aefb89057c1c6bab845df896777bc97230ae3
SHA25663f607b4cd4804876dd817163529180a18a30245aefc92e1ea79eaea6348a121
SHA512d6853305f9f26a09e98ad270498d57f52a604667984c754c3f7aab5d5f3270416e25e9c328981d63b2675c661da5f454c290cf291c932338593ae80f8e85fc9d
-
Filesize
2.7MB
MD548d72055c656230bed2ebc5831008349
SHA1158a1540a163a2e47eae9426e89b10febb86d7ec
SHA25628bbe25cec4284374cd34fcb0bc1b203a5663de1383927640cc6c9ed40788634
SHA512c72186e9deb21e811923f128da31c9053271826f9acdebe18c38d5730bb34eda9a9dc4cf0baf5926e071fb388272799a180c827c04a1b953523876dc7af04e3f
-
Filesize
1.8MB
MD59e50d297946c37d3a1d1da00762d4e48
SHA1f7c1f6d79350183902532f4f74c55110099418b7
SHA2564578d207fc6610750df1d6005c8e1ba3c00bdf9b89d8ac6d49bb4e6904729062
SHA512e6a29fabdf67f7080513a2ef677e324f8c94817c9504ab020a034a9fa6ae12c7935963be490842ace30b458ff8d51a9229887ff3a8bdca1b80472cc80925f114