Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/01/2025, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
4bc7776abc694066adf8b7506ba4d540.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4bc7776abc694066adf8b7506ba4d540.exe
Resource
win10v2004-20241007-en
General
-
Target
4bc7776abc694066adf8b7506ba4d540.exe
-
Size
1.8MB
-
MD5
4bc7776abc694066adf8b7506ba4d540
-
SHA1
be2a421fbc2b9aacd8a366ab8a127e62f2521d4e
-
SHA256
60e96b3d426418f0c91ae353d30c55adbfa60182f684f84a7657e5a07338f570
-
SHA512
4d756d3872e42cb589fe0b8b1507090452d0dd37ad8562cda4f76989a7642478d016bc4d650d4fb4d7cad7142d7a37cf747d477eb3811c8a9ee40c5a9a4d2ce5
-
SSDEEP
49152:Uwg0AEKh+JcngNxupyhoe12eWB8OtGClEzIJ:UwdAvcvNcpyhD3WGO6E
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4bc7776abc694066adf8b7506ba4d540.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4bc7776abc694066adf8b7506ba4d540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4bc7776abc694066adf8b7506ba4d540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 1 IoCs
pid Process 2532 skotes.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine 4bc7776abc694066adf8b7506ba4d540.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine skotes.exe -
Loads dropped DLL 2 IoCs
pid Process 2428 4bc7776abc694066adf8b7506ba4d540.exe 2428 4bc7776abc694066adf8b7506ba4d540.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2428 4bc7776abc694066adf8b7506ba4d540.exe 2532 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 4bc7776abc694066adf8b7506ba4d540.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4bc7776abc694066adf8b7506ba4d540.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2428 4bc7776abc694066adf8b7506ba4d540.exe 2532 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2428 4bc7776abc694066adf8b7506ba4d540.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2532 2428 4bc7776abc694066adf8b7506ba4d540.exe 30 PID 2428 wrote to memory of 2532 2428 4bc7776abc694066adf8b7506ba4d540.exe 30 PID 2428 wrote to memory of 2532 2428 4bc7776abc694066adf8b7506ba4d540.exe 30 PID 2428 wrote to memory of 2532 2428 4bc7776abc694066adf8b7506ba4d540.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bc7776abc694066adf8b7506ba4d540.exe"C:\Users\Admin\AppData\Local\Temp\4bc7776abc694066adf8b7506ba4d540.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD54bc7776abc694066adf8b7506ba4d540
SHA1be2a421fbc2b9aacd8a366ab8a127e62f2521d4e
SHA25660e96b3d426418f0c91ae353d30c55adbfa60182f684f84a7657e5a07338f570
SHA5124d756d3872e42cb589fe0b8b1507090452d0dd37ad8562cda4f76989a7642478d016bc4d650d4fb4d7cad7142d7a37cf747d477eb3811c8a9ee40c5a9a4d2ce5