Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/02/2025, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
random.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
random.exe
Resource
win10ltsc2021-20250207-en
General
-
Target
random.exe
-
Size
1.8MB
-
MD5
ebb19356f4a1f8d9aa63efcad72818a6
-
SHA1
005666bf6270b976c4e2c2faf13491da29389c7e
-
SHA256
8313c081a92b8c3e8debe8b6662ce1531cbf3d0e6464c1a6d0ee178568a52c40
-
SHA512
f4821767f3056ad7c2a58de117667b28a1a2e619d495cf3238a7f36aedc8bb0b4add7affd0cc0ae9020991f28c6f67b4dee1d937920eff99e9789ea1b0a95ec8
-
SSDEEP
49152:VfVcxMJmPwpUkpePPp9gkCuHswI68sgJ:VfIPkKItyr8sgJ
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ A2652ZRPR2XD63S18PPAPSLKAWYP.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe -
Downloads MZ/PE file 2 IoCs
flow pid Process 8 2188 random.exe 9 2188 random.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion A2652ZRPR2XD63S18PPAPSLKAWYP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion A2652ZRPR2XD63S18PPAPSLKAWYP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 2 IoCs
pid Process 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 1764 skotes.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine random.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine A2652ZRPR2XD63S18PPAPSLKAWYP.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine skotes.exe -
Loads dropped DLL 4 IoCs
pid Process 2188 random.exe 2188 random.exe 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2188 random.exe 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 1764 skotes.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job A2652ZRPR2XD63S18PPAPSLKAWYP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2652ZRPR2XD63S18PPAPSLKAWYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language random.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2188 random.exe 2188 random.exe 2188 random.exe 2188 random.exe 2188 random.exe 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 1764 skotes.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2284 2188 random.exe 32 PID 2188 wrote to memory of 2284 2188 random.exe 32 PID 2188 wrote to memory of 2284 2188 random.exe 32 PID 2188 wrote to memory of 2284 2188 random.exe 32 PID 2284 wrote to memory of 1764 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 33 PID 2284 wrote to memory of 1764 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 33 PID 2284 wrote to memory of 1764 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 33 PID 2284 wrote to memory of 1764 2284 A2652ZRPR2XD63S18PPAPSLKAWYP.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\A2652ZRPR2XD63S18PPAPSLKAWYP.exe"C:\Users\Admin\AppData\Local\Temp\A2652ZRPR2XD63S18PPAPSLKAWYP.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1764
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5e49eb0e441625b8cd5ab5241449addf1
SHA196a28bc2a6105f7cbf7297728eff394d417d5364
SHA2565b29145293b504d880d928aa97f1fb5b9e3fc04c55b4ec687b97c9f410adec91
SHA512b61922d2728fda759ae8008f4b594152707e9de217c70107c9c89317815d4298cf87b57a006dab9c11d0202f4ebdf943314691a378e77828ff37f8fcbdc22e83