Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4922b1d0956d96acd6d5b78c6a271bc2a60f89049534e16892bc1a609b491617

  • Size

    6.7MB

  • Sample

    221129-nh5caadh48

  • MD5

    929e2ceca042dfec03410088417e1ec9

  • SHA1

    a8e7722fba8a82749540392e97a021f7da11a15a

  • SHA256

    4922b1d0956d96acd6d5b78c6a271bc2a60f89049534e16892bc1a609b491617

  • SHA512

    7eca85a678db3f3de9a0394f1bb38d5a04946c3d5c99195ccb03a8a35fbc980b2710fddd55b39f4062528fdea8f949c48bd320c84f58a019f5e77bf721e6504c

  • SSDEEP

    196608:fW/3OXYUiKiS46IXAV9k7IFEiC4E36njt37:fWGoUgS46wtYFs2jtr

Score
9/10

Malware Config

Targets

    • Target

      4922b1d0956d96acd6d5b78c6a271bc2a60f89049534e16892bc1a609b491617

    • Size

      6.7MB

    • MD5

      929e2ceca042dfec03410088417e1ec9

    • SHA1

      a8e7722fba8a82749540392e97a021f7da11a15a

    • SHA256

      4922b1d0956d96acd6d5b78c6a271bc2a60f89049534e16892bc1a609b491617

    • SHA512

      7eca85a678db3f3de9a0394f1bb38d5a04946c3d5c99195ccb03a8a35fbc980b2710fddd55b39f4062528fdea8f949c48bd320c84f58a019f5e77bf721e6504c

    • SSDEEP

      196608:fW/3OXYUiKiS46IXAV9k7IFEiC4E36njt37:fWGoUgS46wtYFs2jtr

    Score
    9/10
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks