Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
fd14d30672cc6a018672f580f564718a.exe
Resource
win7-20240903-en
General
-
Target
fd14d30672cc6a018672f580f564718a.exe
-
Size
1.9MB
-
MD5
fd14d30672cc6a018672f580f564718a
-
SHA1
483009421360614e863a11154be348e19f111f8c
-
SHA256
d3f95d99814d66986a7a2edfb3961b6fb96363f8ce989d85a603fadb3a866ab5
-
SHA512
35f6e4913ecc30c73d29a6ce023ab0b675a136aa1f4575c3c92652bcd9f65b6e6bc145026f658694f8e98d9229b2f00ae793202d9c2982e7fd1e2032565a1cc7
-
SSDEEP
49152:zktA/ANosZjs8LeoJCf1q8+P/E2EwSIc9v4dkpeDnER3i:+51RdEx+RjUwd+ek
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fd14d30672cc6a018672f580f564718a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fd14d30672cc6a018672f580f564718a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fd14d30672cc6a018672f580f564718a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 1 IoCs
pid Process 2760 skotes.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine fd14d30672cc6a018672f580f564718a.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine skotes.exe -
Loads dropped DLL 2 IoCs
pid Process 2012 fd14d30672cc6a018672f580f564718a.exe 2012 fd14d30672cc6a018672f580f564718a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2012 fd14d30672cc6a018672f580f564718a.exe 2760 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job fd14d30672cc6a018672f580f564718a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd14d30672cc6a018672f580f564718a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2012 fd14d30672cc6a018672f580f564718a.exe 2760 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 fd14d30672cc6a018672f580f564718a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2760 2012 fd14d30672cc6a018672f580f564718a.exe 30 PID 2012 wrote to memory of 2760 2012 fd14d30672cc6a018672f580f564718a.exe 30 PID 2012 wrote to memory of 2760 2012 fd14d30672cc6a018672f580f564718a.exe 30 PID 2012 wrote to memory of 2760 2012 fd14d30672cc6a018672f580f564718a.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd14d30672cc6a018672f580f564718a.exe"C:\Users\Admin\AppData\Local\Temp\fd14d30672cc6a018672f580f564718a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5fd14d30672cc6a018672f580f564718a
SHA1483009421360614e863a11154be348e19f111f8c
SHA256d3f95d99814d66986a7a2edfb3961b6fb96363f8ce989d85a603fadb3a866ab5
SHA51235f6e4913ecc30c73d29a6ce023ab0b675a136aa1f4575c3c92652bcd9f65b6e6bc145026f658694f8e98d9229b2f00ae793202d9c2982e7fd1e2032565a1cc7