Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2023, 01:46

General

  • Target

    arphaCrashReport.exe

  • Size

    206KB

  • MD5

    8521949e487368f1708d68ffcc581665

  • SHA1

    a2c753371ba79eb673ff4987d9044af9c7a1b89b

  • SHA256

    b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2

  • SHA512

    7722abb534f11dc71ac0797d881eb5c2dee524e19d99c219697efa1037164d92a23a5f098f76e5471f1bcfbcb05b44c497ba85f724267cb70591a448af4358ba

  • SSDEEP

    6144:UJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg:SGQ8y3CtcoRv6i

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\arphaCrashReport.exe
    "C:\Users\Admin\AppData\Local\Temp\arphaCrashReport.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Users\Admin\AppData\Local\Temp\arphaCrashReport.exe
      "C:\Users\Admin\AppData\Local\Temp\arphaCrashReport.exe" 9999
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2664-7-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/2664-1-0x00000000771B4000-0x00000000771B6000-memory.dmp

    Filesize

    8KB

  • memory/2664-3-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/2664-5-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/2664-4-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/2664-0-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-14-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-20-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-9-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-11-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-12-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-13-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-6-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-15-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-16-0x00000000012D0000-0x00000000012D1000-memory.dmp

    Filesize

    4KB

  • memory/4948-17-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-19-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-10-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

    Filesize

    4KB

  • memory/4948-21-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-22-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-23-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-24-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-25-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-26-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-27-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-28-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB

  • memory/4948-29-0x0000000010000000-0x0000000010CC0000-memory.dmp

    Filesize

    12.8MB