Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ENQUIRY.exe

windows7-x64

7

ENQUIRY.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ENQUIRY.exe

  • Size

    276KB

  • Sample

    230216-rz96msaa45

  • MD5

    08206478008c4b80e773c58dfc58689e

  • SHA1

    cc08199d58a3a8ce2572e8645d61f11935674c58

  • SHA256

    e2fe236e6e2b1abaccc15b23a60e5b3d0cdc171d1ef4de601e469ddcf3919596

  • SHA512

    63474a731300b105d8d153ab5b36e87d6a6eacc542cd15e88d40f60c24ede0d2363501e95a9f41aa4c4229b937c4b01d99bbeb745d23a5b84de0ad129876ae54

  • SSDEEP

    6144:2yIu6ShXKfliNr78ILMB1vEsigAg7aIKPxa:8ShXKm78CMwRVta

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      ENQUIRY.exe

    • Size

      276KB

    • MD5

      08206478008c4b80e773c58dfc58689e

    • SHA1

      cc08199d58a3a8ce2572e8645d61f11935674c58

    • SHA256

      e2fe236e6e2b1abaccc15b23a60e5b3d0cdc171d1ef4de601e469ddcf3919596

    • SHA512

      63474a731300b105d8d153ab5b36e87d6a6eacc542cd15e88d40f60c24ede0d2363501e95a9f41aa4c4229b937c4b01d99bbeb745d23a5b84de0ad129876ae54

    • SSDEEP

      6144:2yIu6ShXKfliNr78ILMB1vEsigAg7aIKPxa:8ShXKm78CMwRVta

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks