Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
22/09/2023, 02:26
General
-
Target
80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb.exe
-
Size
13.3MB
-
MD5
9ac3f09bbc9f5310ea51c15d347616ce
-
SHA1
3647ee26a5f8b629f9c29dfaec0e6ac42c71478b
-
SHA256
80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb
-
SHA512
2c357b6f51462c673fa82fb2941554a7735e9d30580c77707f0f9c7fac42a9c17e1d6f9494b2bb25ebc8cba458bde8af4c5868ee26e17597a2286d2f352b75e8
-
SSDEEP
393216:jq94Usc5SuJMW7cs2UtQqfJPLi4LMp+Vz:eeUzcuJMW73G0LibgV
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb.exe"C:\Users\Admin\AppData\Local\Temp\80131f5302fffccf86ee3a48544fd039a64faf77b1f6f6216a450d37fd9cf8cb.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5b93ac2143be6021cba4663789fb365d4
SHA12b90c3c5500b679dc8d4a600ca718cfc66c08060
SHA25625b299706935e534f66233e25b9c8609b8081e003c9bc82f7a15105c336a7359
SHA5126a247a0386708b6d528d40bee85bcfb5a591c60cf6a5a92e7149fb3203c4a1a8aef6b75579403c92a5188bfdc3f7604fd251718b8c50eee2bd707feeb4c1f108
-
Filesize
3.0MB
MD5b93ac2143be6021cba4663789fb365d4
SHA12b90c3c5500b679dc8d4a600ca718cfc66c08060
SHA25625b299706935e534f66233e25b9c8609b8081e003c9bc82f7a15105c336a7359
SHA5126a247a0386708b6d528d40bee85bcfb5a591c60cf6a5a92e7149fb3203c4a1a8aef6b75579403c92a5188bfdc3f7604fd251718b8c50eee2bd707feeb4c1f108
-
Filesize
6.3MB
-
Filesize
8KB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
4KB
-
Filesize
6.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
6.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB