diff --git a/stix2/test/v21/test_malware.py b/stix2/test/v21/test_malware.py
index 53838c9..412d740 100644
--- a/stix2/test/v21/test_malware.py
+++ b/stix2/test/v21/test_malware.py
@@ -197,3 +197,22 @@ def test_malware_non_family_no_name():
         "is_family": False,
         "malware_types": ["something"],
     })
+
+
+def test_malware_with_os_refs():
+    software = stix2.parse({
+        "type": "software",
+        "name": "SuperOS",
+        "spec_version": "2.1",
+    })
+
+    malware = stix2.parse({
+        "type": "malware",
+        "id": MALWARE_ID,
+        "spec_version": "2.1",
+        "is_family": False,
+        "malware_types": ["something"],
+        "operating_system_refs": [software],
+    })
+
+    assert malware["operating_system_refs"][0] == software["id"]
diff --git a/stix2/v21/sdo.py b/stix2/v21/sdo.py
index 1d97261..5c87515 100644
--- a/stix2/v21/sdo.py
+++ b/stix2/v21/sdo.py
@@ -460,7 +460,7 @@ class Malware(STIXDomainObject):
         ('kill_chain_phases', ListProperty(KillChainPhase)),
         ('first_seen', TimestampProperty()),
         ('last_seen', TimestampProperty()),
-        ('os_execution_envs', ListProperty(StringProperty)),
+        ('operating_system_refs', ListProperty(ReferenceProperty(valid_types='software', spec_version='2.1'))),
         ('architecture_execution_envs', ListProperty(StringProperty)),
         ('implementation_languages', ListProperty(StringProperty)),
         ('capabilities', ListProperty(StringProperty)),