Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/11/2022, 08:08
221111-j1y6rscebm 1012/05/2022, 21:09
220512-zzj88aabg5 1011/05/2022, 17:34
220511-v5d7yahaan 10Analysis
-
max time kernel
167s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12/05/2022, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
New Folder.lnk
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
New Folder.lnk
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
desk.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral4
Sample
desk.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
desk.dll
-
Size
1.2MB
-
MD5
b07d064220b48ac3b110e6ebe1e4f542
-
SHA1
c3bb172894a4e0e1ecc93fcd1bd78450ab4ca195
-
SHA256
25ccf19af5dac51ec76ce6da1d2958d5dee34e50e78938b187b627f8771317d1
-
SHA512
d169d11b492e465e31fa98e4b185a2161e1ff739757f7e139f9c63605af3d9a15813a538801d569f75de02de26a243dd40b7d46d074ffda445dd70c1860e1c74
Malware Config
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe 1336 rundll32.exe