Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5444f8a0e98b215d50531dcfa516cd184fdd534e85eeffda21b0337c78425d5b

  • Size

    4.2MB

  • Sample

    231010-d3wwjaae2x

  • MD5

    43a3be1c25a72b96cd73bd96e00432f8

  • SHA1

    7e3728f783719ef365dbd88502d803dce647160e

  • SHA256

    5444f8a0e98b215d50531dcfa516cd184fdd534e85eeffda21b0337c78425d5b

  • SHA512

    18b1628bfbd41156d26739f231e140c08c7dc15ae5725a15bcf12d656b36ca0ec7867635dd4cdfc03408d50039f4b917284f3462b88aa2ee64ad6497c622bc16

  • SSDEEP

    98304:IKwWceyQx/+PG3/ERL61GgIq47AkpLF3g0HbMjO4C08:Il6hNvERLalkp9xHbTb08

Malware Config

Targets

    • Target

      5444f8a0e98b215d50531dcfa516cd184fdd534e85eeffda21b0337c78425d5b

    • Size

      4.2MB

    • MD5

      43a3be1c25a72b96cd73bd96e00432f8

    • SHA1

      7e3728f783719ef365dbd88502d803dce647160e

    • SHA256

      5444f8a0e98b215d50531dcfa516cd184fdd534e85eeffda21b0337c78425d5b

    • SHA512

      18b1628bfbd41156d26739f231e140c08c7dc15ae5725a15bcf12d656b36ca0ec7867635dd4cdfc03408d50039f4b917284f3462b88aa2ee64ad6497c622bc16

    • SSDEEP

      98304:IKwWceyQx/+PG3/ERL61GgIq47AkpLF3g0HbMjO4C08:Il6hNvERLalkp9xHbTb08

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks