Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
a6410cca2ceacc80095a22fdc0f936ba.exe
Resource
win7-20241023-en
General
-
Target
a6410cca2ceacc80095a22fdc0f936ba.exe
-
Size
1.2MB
-
MD5
a6410cca2ceacc80095a22fdc0f936ba
-
SHA1
d680defe60f055c02ec48f83a76a826969d50e0e
-
SHA256
1dc6af93e4c02db3d98e4fdbe10e638d4a88685ef79345d12c1424aaeadf0482
-
SHA512
0ed1237e80aba1321503de746aff9e6672376f85461ccee463a5454ab3e8b2a2092e098002a761c1ca1f12c91e23baed90deb3d8071be48fd46cfdd784567797
-
SSDEEP
24576:X5GJSGdYXqbG7BRwqGHYj7yeqCLi9/Ir6U1cMTOx4fu40gxUm:X5GhdUNDmYj7nqM0/IHj24r0gxU
Malware Config
Extracted
amadey
5.04
b44aeb
-
install_dir
7725ce688f
-
install_file
Gxtuum.exe
-
strings_key
8bf9b3f72bb53c678e0173edf42df1ae
-
url_paths
/3ofn3jf3e2ljk/index.php
Signatures
-
Amadey family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
description pid Process procid_target PID 4008 created 3424 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 56 PID 2256 created 3424 2256 Gxtuum.exe 56 PID 3916 created 3424 3916 Gxtuum.exe 56 PID 2840 created 3424 2840 Gxtuum.exe 56 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation a6410cca2ceacc80095a22fdc0f936ba.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vminfo.vbs a6410cca2ceacc80095a22fdc0f936ba.exe -
Executes dropped EXE 6 IoCs
pid Process 2256 Gxtuum.exe 3248 Gxtuum.exe 3916 Gxtuum.exe 3704 Gxtuum.exe 2840 Gxtuum.exe 2756 Gxtuum.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4008 set thread context of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 2256 set thread context of 3248 2256 Gxtuum.exe 101 PID 3916 set thread context of 3704 3916 Gxtuum.exe 104 PID 2840 set thread context of 2756 2840 Gxtuum.exe 106 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Gxtuum.job a6410cca2ceacc80095a22fdc0f936ba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6410cca2ceacc80095a22fdc0f936ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6410cca2ceacc80095a22fdc0f936ba.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 2256 Gxtuum.exe 3916 Gxtuum.exe 2840 Gxtuum.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4008 a6410cca2ceacc80095a22fdc0f936ba.exe Token: SeDebugPrivilege 4008 a6410cca2ceacc80095a22fdc0f936ba.exe Token: SeDebugPrivilege 2256 Gxtuum.exe Token: SeDebugPrivilege 2256 Gxtuum.exe Token: SeDebugPrivilege 3916 Gxtuum.exe Token: SeDebugPrivilege 3916 Gxtuum.exe Token: SeDebugPrivilege 2840 Gxtuum.exe Token: SeDebugPrivilege 2840 Gxtuum.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4192 a6410cca2ceacc80095a22fdc0f936ba.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4008 wrote to memory of 4192 4008 a6410cca2ceacc80095a22fdc0f936ba.exe 96 PID 4192 wrote to memory of 2256 4192 a6410cca2ceacc80095a22fdc0f936ba.exe 97 PID 4192 wrote to memory of 2256 4192 a6410cca2ceacc80095a22fdc0f936ba.exe 97 PID 4192 wrote to memory of 2256 4192 a6410cca2ceacc80095a22fdc0f936ba.exe 97 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 2256 wrote to memory of 3248 2256 Gxtuum.exe 101 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 3916 wrote to memory of 3704 3916 Gxtuum.exe 104 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106 PID 2840 wrote to memory of 2756 2840 Gxtuum.exe 106
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\a6410cca2ceacc80095a22fdc0f936ba.exe"C:\Users\Admin\AppData\Local\Temp\a6410cca2ceacc80095a22fdc0f936ba.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\a6410cca2ceacc80095a22fdc0f936ba.exe"C:\Users\Admin\AppData\Local\Temp\a6410cca2ceacc80095a22fdc0f936ba.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Executes dropped EXE
PID:3704
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Executes dropped EXE
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a6410cca2ceacc80095a22fdc0f936ba
SHA1d680defe60f055c02ec48f83a76a826969d50e0e
SHA2561dc6af93e4c02db3d98e4fdbe10e638d4a88685ef79345d12c1424aaeadf0482
SHA5120ed1237e80aba1321503de746aff9e6672376f85461ccee463a5454ab3e8b2a2092e098002a761c1ca1f12c91e23baed90deb3d8071be48fd46cfdd784567797