Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

08b28675a2...e1.exe

windows7-x64

9

08b28675a2...e1.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1

  • Size

    3.5MB

  • Sample

    221206-vkj8fsac9v

  • MD5

    254dcf23c7850a156e31e8a4f63f6665

  • SHA1

    a67018ebe42793bead68749d7035934341b6515c

  • SHA256

    08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1

  • SHA512

    a0143a733f494e66cd5432a07c44bafc18abd26226107b038d6932cf0434b9897a6599569ef6aa21c294690d2177bbe0ec4fb0daf6c05a452dddd8632df99690

  • SSDEEP

    98304:iP87eh6bRyDuA54GMD6DPArJ5qgUrCxOTtOe:k84CIU64rJ5qgqCxOTth

Score
9/10
evasionpersistence

Malware Config

Targets

    • Target

      08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1

    • Size

      3.5MB

    • MD5

      254dcf23c7850a156e31e8a4f63f6665

    • SHA1

      a67018ebe42793bead68749d7035934341b6515c

    • SHA256

      08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1

    • SHA512

      a0143a733f494e66cd5432a07c44bafc18abd26226107b038d6932cf0434b9897a6599569ef6aa21c294690d2177bbe0ec4fb0daf6c05a452dddd8632df99690

    • SSDEEP

      98304:iP87eh6bRyDuA54GMD6DPArJ5qgUrCxOTtOe:k84CIU64rJ5qgqCxOTth

    Score
    9/10
    evasionpersistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks