Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20250218-en -
resource tags
-
submitted
10/03/2025, 18:48
General
-
Target
SpyNote-V7.3.1.zip
-
Size
132.8MB
-
MD5
e4f1d7f911262ec816ca98cfeb6126d3
-
SHA1
8dbcea8c9ccccc3a002bd9262ee5bad8920f6167
-
SHA256
fa0cfe8274608f23cef8c819fb121d55c4750e28f484ebdb37d57878c665aa5d
-
SHA512
fb147f4d03e1a6d54a649dd214c2d9c1acb495de66092dd205da119cff0492c647783bfb80ce19f0d86452fefb68b64569617ba9b7a6592c36bef59cd134fc59
-
SSDEEP
3145728:CInrJgElMeW/ZL170hS15nrJgEUsanBG9XI2qiKLz4:CSFp25/d1hlFpUNBz2qPLk
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 54 IoCs
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SpyNote-V7.3.1.zip1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3664,i,1287081917707126974,2546641302406706180,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:141⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Documents\SpyNote-V7.3.1\SpyNote.exe"C:\Users\Admin\Documents\SpyNote-V7.3.1\SpyNote.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\SpyNote-V7.3.1\payload.exe"C:\Users\Admin\Documents\SpyNote-V7.3.1\payload.exe" kinP6dl87UCOxRdtpCpI7Ch1AMTUxH/K77Ercy+R6a+stzV7qsTLeshaNDjrSDAjcwyuZJu0vkKTlb1iupcweGjazheCLwbU0KGOFBDpUExDIxlkYdnX87h/C7/gy9eACCasEIUAkYL80G5RfCMpb/T8NHfB7dK3JAeCqz6RhpQjiqOt3r2bpMfRdba4YSU30/d9NlRMQSStX3eR3a/pMSMKN4pLxrKbOBbGf6xHUUEae3r2p6raAM0r0LFmM23ZI10DFxXhtQ/YD4xzNPCynq9C2QIANQggwmeSG+o7l3ovRFnJOix+ROQkQn+SNirHWicR/8cz/MQVeb+Sy2VcCqbuQakKApX1eRXHgTNr2u4=2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 10723⤵
- Program crash
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1116 -ip 11161⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4100,i,1287081917707126974,2546641302406706180,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:141⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
2.3MB
MD55f449db8083ca4060253a0b4f40ff8ae
SHA12b77b8c86fda7cd13d133c93370ff302cd08674b
SHA2567df49cba50cc184b0fbb31349bd9f2b18acf5f7e7fac9670759efa48564eaef1
SHA5124ce668cf2391422ef37963a5fd6c6251d414f63545efb3f1facb77e4695cd5a8af347bd77fc2bebfa7fd3ef10ff413a7acfde32957037a51c59806577351825f
-
Filesize
54B
MD5f026af4415cb44cf2da2647391a360ce
SHA1e48e80ce3d9ac785b3aaa6a9d56cd0ea9aa57f20
SHA25657e2be780fd8fc01e6c7cd97ed558638391c76c17fc6f7c075c705fca5e3b1d4
SHA512adc8c71f559e9f74efbcae37e3b275f9cef40b41f0e135a8b311c38754d75b4c0c6f7d4cbbae95b9c7d611493ae66e1828f8fa9615ef71208e8e43de23e71bcc
-
Filesize
10.0MB
-
Filesize
10.0MB
-
Filesize
10.0MB
-
Filesize
10.0MB
-
Filesize
200KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
552KB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
472KB
-
Filesize
400KB
-
Filesize
136KB
-
Filesize
208KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
704KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
18.0MB
-
Filesize
5.9MB
-
Filesize
5.9MB