Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24/11/2022, 08:28
General
-
Target
96e8cedac882753215bc7b3a604ae264732c9bb27281ab786f64eba36c7eac6a.exe
-
Size
2.7MB
-
MD5
0241f64e37ce54ae515dab9b5cf55819
-
SHA1
d85fbc255084e72986fa4a26892857dc7afed077
-
SHA256
96e8cedac882753215bc7b3a604ae264732c9bb27281ab786f64eba36c7eac6a
-
SHA512
95d482027c11d600ebacdab75124eb247073e9736c18d790359ba334bd41a817d98bf1924d93603ee105f683b938db87a8942fbdfd624ddd8228de74b44c1c26
-
SSDEEP
49152:zCe2mnTNlAj7ohElUAItsvel+PlxXneJ/oazioS78KOHHgiOOI:zCmTNXvAItsdlNeFVU78pHHgh
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96e8cedac882753215bc7b3a604ae264732c9bb27281ab786f64eba36c7eac6a.exe"C:\Users\Admin\AppData\Local\Temp\96e8cedac882753215bc7b3a604ae264732c9bb27281ab786f64eba36c7eac6a.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
-
Filesize
8KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB