Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

80131f5302...cb.exe

windows7-x64

9

80131f5302...cb.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb

  • Size

    13.3MB

  • Sample

    230922-cw5pesca4t

  • MD5

    9ac3f09bbc9f5310ea51c15d347616ce

  • SHA1

    3647ee26a5f8b629f9c29dfaec0e6ac42c71478b

  • SHA256

    80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb

  • SHA512

    2c357b6f51462c673fa82fb2941554a7735e9d30580c77707f0f9c7fac42a9c17e1d6f9494b2bb25ebc8cba458bde8af4c5868ee26e17597a2286d2f352b75e8

  • SSDEEP

    393216:jq94Usc5SuJMW7cs2UtQqfJPLi4LMp+Vz:eeUzcuJMW73G0LibgV

Score
9/10
evasionvmprotect

Malware Config

Targets

    • Target

      80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb

    • Size

      13.3MB

    • MD5

      9ac3f09bbc9f5310ea51c15d347616ce

    • SHA1

      3647ee26a5f8b629f9c29dfaec0e6ac42c71478b

    • SHA256

      80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb

    • SHA512

      2c357b6f51462c673fa82fb2941554a7735e9d30580c77707f0f9c7fac42a9c17e1d6f9494b2bb25ebc8cba458bde8af4c5868ee26e17597a2286d2f352b75e8

    • SSDEEP

      393216:jq94Usc5SuJMW7cs2UtQqfJPLi4LMp+Vz:eeUzcuJMW73G0LibgV

    Score
    9/10
    evasionvmprotect

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks