Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27/11/2022, 14:41
General
-
Target
3km2-20120528[1117]/3K20120528(0404)合击引擎/Mir200/M2Server.exe
-
Size
3.4MB
-
MD5
c2da6a2920b67b4c888c7209e55e484a
-
SHA1
296d2aec76116c25b3550b52d80d94440d3a783e
-
SHA256
e9be4facf1882e685aebe9703664715523c21995fdf9c19197da9a0a6adf8f4d
-
SHA512
edf04caabe60bef22e05075496eff89c40d6ecce4eb2f717a3881596bc3d0953bea594f125725893c274e84de9b9008a076a52126e2da87d1b210470d3d57144
-
SSDEEP
98304:eQ8PU3vL2A4ZMNbEhy7DpeSrsK+AZH2c4+:h8sh9y2dXfZHR1
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3km2-20120528[1117]\3K20120528(0404)合击引擎\Mir200\M2Server.exe"C:\Users\Admin\AppData\Local\Temp\3km2-20120528[1117]\3K20120528(0404)合击引擎\Mir200\M2Server.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
1.2MB
-
Filesize
400KB
-
Filesize
4.0MB
-
Filesize
212KB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
4.0MB