Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe
Resource
win10v2004-20220812-en
General
-
Target
af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe
-
Size
650KB
-
MD5
ac1a2ce06f7961a80b1323ded7403435
-
SHA1
97c5489b1abdbe7c3aa994fba7e55e22a43180e2
-
SHA256
af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab
-
SHA512
47f476b2b17c0d254277e5af811141588dd8d9f5edd4cbb2e3b36c927173060209438cc98e584bd0f923dc45eecd90841cb8c06b3a0a755b845b325dea490d4e
-
SSDEEP
12288:TDBDrRvl1ExbmotxmBEQwHEv8R0xOI4Hyrsp6/quh:TlHZLEx1txmeC74+j/quh
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe"C:\Users\Admin\AppData\Local\Temp\af7fd48a420ff79f1cd8079f11e85c62053b1e75a302c4bb846a3732a875e5ab.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
PID:1296