Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/04/2023, 00:19
Behavioral task
behavioral1
Sample
OREWFLAJVDPPEA.exe
Resource
win7-20230220-en
5 signatures
150 seconds
General
-
Target
OREWFLAJVDPPEA.exe
-
Size
22.5MB
-
MD5
ee054dd3be1b4d7b68ff8a7131a9abc8
-
SHA1
bd064b20ff7d802220833fcbf922bb86fc796f85
-
SHA256
1afb00d93e1299f8a51a42d25841ef1fb7ce686c30cbd80e5efe327b4dce4e43
-
SHA512
033e48b71db8f5992a9237be68b59a95742342fbc4d2975761c6948233cf5a77aa41da91894bfdbc7e73cba39c55856fe33ad19a58ddacf4b56cc03e5d79b876
-
SSDEEP
393216:SOaORp/IA1I+zjCXXonzxiBjYmW6EMdeC0WjKrcrWGq58a8eJpadc6mxvJLnRr2:PHVIAXzjqglOYmBdc4rWGt7mxvJLnRS
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ OREWFLAJVDPPEA.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion OREWFLAJVDPPEA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion OREWFLAJVDPPEA.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OREWFLAJVDPPEA.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 628 OREWFLAJVDPPEA.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 628 OREWFLAJVDPPEA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OREWFLAJVDPPEA.exe"C:\Users\Admin\AppData\Local\Temp\OREWFLAJVDPPEA.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:628