Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 12:23

General

  • Target

    927b52ceb05c1d98881bbf55972f299bb63df6d80e9f0376c992b676b8528023.exe

  • Size

    1.4MB

  • MD5

    84c77843c34739ad04f14bbc32ce57bb

  • SHA1

    f05532638bc3831bbc470d99f2d3670c029565a0

  • SHA256

    927b52ceb05c1d98881bbf55972f299bb63df6d80e9f0376c992b676b8528023

  • SHA512

    838d885c79c5fe2e4fc7c0c871faf1fb0ffa8e7f27406bde60ba6f5584344404a3813f8d28fd7be4d79f6bc444dbcd0a8fe31f40cb5b9f23e919da0098d02142

  • SSDEEP

    24576:SL+l6Npe1dbiFElnuGxC/WubnpHNWnuZ/:sNHFElnuGx8bJ/

Score
7/10

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1432
      • C:\Users\Admin\AppData\Local\Temp\927b52ceb05c1d98881bbf55972f299bb63df6d80e9f0376c992b676b8528023.exe
        "C:\Users\Admin\AppData\Local\Temp\927b52ceb05c1d98881bbf55972f299bb63df6d80e9f0376c992b676b8528023.exe"
        2⤵
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1736

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1432-66-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

      Filesize

      24KB

    • memory/1736-54-0x0000000000400000-0x0000000000A4DB76-memory.dmp

      Filesize

      6.3MB

    • memory/1736-60-0x0000000000400000-0x0000000000A4DB76-memory.dmp

      Filesize

      6.3MB

    • memory/1736-61-0x0000000000400000-0x0000000000A4DB76-memory.dmp

      Filesize

      6.3MB

    • memory/1736-62-0x0000000000400000-0x0000000000A4DB76-memory.dmp

      Filesize

      6.3MB

    • memory/1736-63-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

      Filesize

      8KB

    • memory/1736-64-0x0000000000400000-0x0000000000A4DB76-memory.dmp

      Filesize

      6.3MB

    • memory/1736-65-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB

    • memory/1736-69-0x0000000000400000-0x0000000000A4DB76-memory.dmp

      Filesize

      6.3MB