Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

f71be5a1b3...in.exe

windows7_x64

9

f71be5a1b3...in.exe

windows10_x64

9

Analysis

  • max time kernel
    90s
  • max time network
    6s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    21/07/2020, 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe

  • Size

    3.8MB

  • MD5

    79a7de437dad73c33490fc8dd3f9d6c5

  • SHA1

    3ebd89f9bf858ae9f6d460fde0875ef2061c8535

  • SHA256

    f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0

  • SHA512

    152990cbc3ccf22d08326a2e5f58cb0f8c96f7d5e20a82a90b894061df85cef800b6e26ee325ced9cea468e7f83fee3f6a6277efdb7d95db81f6517e824e0f73

Score
9/10
evasiontrojan

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Loads dropped DLL 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\f71be5a1b3f5a867f29b4a7d765affe4826c8366450ca6cc2b2839a4c34fa0f0.bin.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ключи.txt
      2⤵
        PID:1616
      • C:\Users\Admin\AppData\Local\Temp\start.exe
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        2⤵
        • Loads dropped DLL
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1020
        • C:\Users\Admin\AppData\Local\Temp\ESETNOD.exe
          ESETNOD.exe
          3⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1084

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1084-14-0x0000000002F60000-0x0000000002F64000-memory.dmp

      Filesize

      16KB

      Download

    • memory/1084-15-0x0000000002B60000-0x0000000002B64000-memory.dmp

      Filesize

      16KB

      Download