Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 12:17
Static task
static1
General
-
Target
79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe
-
Size
6.8MB
-
MD5
d95af1d7cfb7d479b778c2c42bc73541
-
SHA1
ebb2703a14e4b1a25a19b77d40fb425b1fd20c4f
-
SHA256
79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50
-
SHA512
51d2b32821aa31db90fbf8110b6aa4988de56bec2d7e7a52c7e8be81aadce7e879d8a8e37c421dacbd8897448680f131d401bd5d5531c86f81edb4558964e171
-
SSDEEP
196608:e1uykutctDkw4DLoVT7QQTmz74n5asW7:e1lsFXxnG85a
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
lumma
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 4Q885X.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 4Q885X.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 4Q885X.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 4Q885X.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 4Q885X.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 4Q885X.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2a3334.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3S75P.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4Q885X.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1d59z5.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4Q885X.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4Q885X.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2a3334.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3S75P.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3S75P.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1d59z5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1d59z5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2a3334.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 1d59z5.exe -
Executes dropped EXE 9 IoCs
pid Process 2816 r9r03.exe 4424 o0a27.exe 4776 1d59z5.exe 3548 skotes.exe 3616 2a3334.exe 5028 3S75P.exe 3680 4Q885X.exe 4328 skotes.exe 1424 skotes.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 1d59z5.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 2a3334.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 3S75P.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine 4Q885X.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 4Q885X.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 4Q885X.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" r9r03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" o0a27.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4776 1d59z5.exe 3548 skotes.exe 3616 2a3334.exe 5028 3S75P.exe 3680 4Q885X.exe 4328 skotes.exe 1424 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 1d59z5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4076 5028 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language r9r03.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o0a27.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d59z5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2a3334.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3S75P.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4Q885X.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3S75P.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3S75P.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4776 1d59z5.exe 4776 1d59z5.exe 3548 skotes.exe 3548 skotes.exe 3616 2a3334.exe 3616 2a3334.exe 5028 3S75P.exe 5028 3S75P.exe 5028 3S75P.exe 5028 3S75P.exe 3680 4Q885X.exe 3680 4Q885X.exe 3680 4Q885X.exe 3680 4Q885X.exe 4328 skotes.exe 4328 skotes.exe 1424 skotes.exe 1424 skotes.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3680 4Q885X.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4776 1d59z5.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2816 2220 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe 83 PID 2220 wrote to memory of 2816 2220 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe 83 PID 2220 wrote to memory of 2816 2220 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe 83 PID 2816 wrote to memory of 4424 2816 r9r03.exe 84 PID 2816 wrote to memory of 4424 2816 r9r03.exe 84 PID 2816 wrote to memory of 4424 2816 r9r03.exe 84 PID 4424 wrote to memory of 4776 4424 o0a27.exe 85 PID 4424 wrote to memory of 4776 4424 o0a27.exe 85 PID 4424 wrote to memory of 4776 4424 o0a27.exe 85 PID 4776 wrote to memory of 3548 4776 1d59z5.exe 86 PID 4776 wrote to memory of 3548 4776 1d59z5.exe 86 PID 4776 wrote to memory of 3548 4776 1d59z5.exe 86 PID 4424 wrote to memory of 3616 4424 o0a27.exe 87 PID 4424 wrote to memory of 3616 4424 o0a27.exe 87 PID 4424 wrote to memory of 3616 4424 o0a27.exe 87 PID 2816 wrote to memory of 5028 2816 r9r03.exe 89 PID 2816 wrote to memory of 5028 2816 r9r03.exe 89 PID 2816 wrote to memory of 5028 2816 r9r03.exe 89 PID 2220 wrote to memory of 3680 2220 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe 108 PID 2220 wrote to memory of 3680 2220 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe 108 PID 2220 wrote to memory of 3680 2220 79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe"C:\Users\Admin\AppData\Local\Temp\79e35b3523c47504bc72eb4c70aaf859a94f01c6369926784b2392ab0b0eca50.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r9r03.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r9r03.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0a27.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0a27.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1d59z5.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1d59z5.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a3334.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a3334.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3S75P.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3S75P.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 15684⤵
- Program crash
PID:4076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Q885X.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Q885X.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5028 -ip 50281⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4328
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1424
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD510028b6d8256496f25456130d84295e4
SHA1d1737800077bc4099e4b2d338e4d015d22e75d0d
SHA2563fba4c97212ec831cc7b2e69cc6aa1a2d12f4c28a8d274318dc7a6dad27f3897
SHA512e98d0086b7393c0c41902f6d2311873f982b6d5820c9ba85f526e862f270d14a27cf015c8ce3f2a7095cf66938c5144618a0f1d4b3bcc2842b84e8ebdf39b6d4
-
Filesize
5.2MB
MD50f4919f5cf0958733fe4009194f1c993
SHA1a179d7bd790fc246b6ecbc373cce7c814fb85b0e
SHA25696fd052b73c087f44241fcd2d0034d52a3968417757a6907e0d9db4de6362b33
SHA5127d791e29d2d93c9219b877f5966f9cfdc727de0821a3a49c5976d681c02dbfadf171b635982e769c470392c253c67f372221314e210a5aa7bedcc12767abad13
-
Filesize
2.8MB
MD5225ad75097a8a68691f54ca412436016
SHA1ff923efc942d2dcaa09e606670d885a33aca006f
SHA2562c2be79b1436a951ac0837e50a624fddc1b2c704c4e1f95f9e0279639f726edc
SHA5122fdbb1228fcd916856a135c9a863403e643cf470ae342e6091e61804e0ef01f235aad32eed2562644912ef0de78e72fd0d8c5a4812c1a9ac4d25617f979f5999
-
Filesize
3.6MB
MD5d2ad6864e40cf8f9eaed2b477451da1a
SHA191e724e3757fa9797bb6d97265784c562f934213
SHA256bdb8da523221e18a019199af8cf0d533b606582bc0f43a9edd3528d7a340abec
SHA512d69ac4e68f99944c121fd063ef7de05f2f3c0da42f72536e4a3c29071d5394d744d931675b83aeb0388ed052fc9c9d191dc9b6547660fe100b1be954c1e5f549
-
Filesize
3.1MB
MD5c276bd1105bf94a6a453275fac1472dd
SHA14518a7fe9d819de8de399d610dedaef6e03de114
SHA256386091ccd3787a0ce0defb33ad982a956f95a8b92a50585c79f2b6f92c744f09
SHA512d8ce36ca8b61c6d0a5609acafbc8e6164d29a287e4f8ad0465e1326fe91d0892d60de26ab64f6a6bc9adc6183ae9ffbcfb5f46abbc693d8ab776eb50cdfb56a7
-
Filesize
1.8MB
MD5f89093f658b52fd17ca15d0209a37ffb
SHA19b2ef977da1e67def11fed9b700b30021fcb1268
SHA256ee10f50454fccad15a37dd298dc052070ccc5dbfa74cd55fa60d6e19bc8fbbb1
SHA512f114a209766f8618c05645f7f29b294ab023886f0ba6c8888d12a6f8dd3b62ee1ac5d6df5147508e465aa80fa4d725a3e5f61812e6e4273f2eb34f882ca2878a