Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17/01/2025, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
random.exe
Resource
win7-20241010-en
General
-
Target
random.exe
-
Size
1.8MB
-
MD5
f930046acafd7c97c30231b17b5d053a
-
SHA1
d442f54bf5d1b61457442a2c110da594dc7825ec
-
SHA256
292eda049137573fc8b923ef58da8218eb5cfab29010e459ba6963434fa1cf7c
-
SHA512
1f96c0b414b39d20264465274dda554b47c6fc32e32468db30d2d4a37efc60bd50184c7d0afc482218f2f6f5de6678958038e581f5e1afbf9324cff7ea98ce2e
-
SSDEEP
24576:rq7KQueAo6rwtCqKGMZaT2Llz2/+9xoWiyOi4F14Mp2f20RQm7QQlZ6sZswi38y:GEIobASlz4ZMOt/QQQl7Z
Malware Config
Extracted
stealc
brat
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine random.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3056 random.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1476 3056 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language random.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString random.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3056 random.exe 3056 random.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1476 3056 random.exe 31 PID 3056 wrote to memory of 1476 3056 random.exe 31 PID 3056 wrote to memory of 1476 3056 random.exe 31 PID 3056 wrote to memory of 1476 3056 random.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 4322⤵
- Program crash
PID:1476
-