Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

25ef66d44b...ae.exe

windows7-x64

9

25ef66d44b...ae.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25ef66d44bc8b5ed72dbc39e1995ba3ec72673d1c5698a9cb0d6d88ed93b17ae

  • Size

    1.7MB

  • Sample

    221206-p3dwhaab56

  • MD5

    b4eef01bc21a819ba8efb859825e3071

  • SHA1

    b9b60dbeba7acb34d56559da7cd3289a88957264

  • SHA256

    25ef66d44bc8b5ed72dbc39e1995ba3ec72673d1c5698a9cb0d6d88ed93b17ae

  • SHA512

    69ce30cdd4781b14e7e6cd90b83d2e4f89208673390a8ee0cb9a0faf7d9bae80c5105dfbedf22066cae64ef7100a29a307eda9df9131eff2a536bed48b7677d7

  • SSDEEP

    24576:iRUpoMcdt/qw+tBXpIJJfq7pyQKddfcKBQ66eyZ6vKe/jmJtPL3unz+Dt2PqNC9L:ipFqZtBX6dqkQQdpi3itrmvzI05cQY

Score
9/10
evasionpersistence

Malware Config

Targets

    • Target

      25ef66d44bc8b5ed72dbc39e1995ba3ec72673d1c5698a9cb0d6d88ed93b17ae

    • Size

      1.7MB

    • MD5

      b4eef01bc21a819ba8efb859825e3071

    • SHA1

      b9b60dbeba7acb34d56559da7cd3289a88957264

    • SHA256

      25ef66d44bc8b5ed72dbc39e1995ba3ec72673d1c5698a9cb0d6d88ed93b17ae

    • SHA512

      69ce30cdd4781b14e7e6cd90b83d2e4f89208673390a8ee0cb9a0faf7d9bae80c5105dfbedf22066cae64ef7100a29a307eda9df9131eff2a536bed48b7677d7

    • SSDEEP

      24576:iRUpoMcdt/qw+tBXpIJJfq7pyQKddfcKBQ66eyZ6vKe/jmJtPL3unz+Dt2PqNC9L:ipFqZtBX6dqkQQdpi3itrmvzI05cQY

    Score
    9/10
    evasionpersistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks