Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

Device/Har...�6.exe

windows7-x64

9

Device/Har...�6.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    餐改6.exe

  • Size

    1.3MB

  • Sample

    231102-qd7myscc6t

  • MD5

    e902a63f295f0241c530555e6f3f4d86

  • SHA1

    0af89e3286b98bf6efcb823d5f55d82e2eebf244

  • SHA256

    2570efe7ad98d35dd23bc3e6e3515b1b49f8fd8b7b4664b82a74bd95c4b00f9c

  • SHA512

    b2b734650e8495bc9f115fad5f644d3b15c44b1cdf00d47c4ac809dffc4a93a133b5c70b9ec77c4ad6ab2883d8a4d6f993b39494f625e3c48a13efccff9452af

  • SSDEEP

    24576:edl37/jvsOYh3UcMR+tZrgrYzCsyjjF7yDhPbDo958ivhv1reU+1/1uChZoPrA:ed5jsJ3U1gZ08zUB7yJfo9aifrXs/IE1

Score
9/10
evasion

Malware Config

Targets

    • Target

      Device/HarddiskVolume8/餐改6/餐改6.exe

    • Size

      1.3MB

    • MD5

      c549534322e16e78a75cf2d1927879c9

    • SHA1

      77255f260792efd1980e39517207d495c9b387bb

    • SHA256

      84a0d72bbca312cfb23a3df88d8519068cce3642546294aa6be189120ff293d5

    • SHA512

      7b9ea5fd0f5a99b26799dd4bed635c063bcc24d3a655197c7c9fd20d525f2def1011c390b4e06fcf3689ffa381429e125c407cb10d80d796271186c9f5f918c1

    • SSDEEP

      24576:a7lbUWqsDldjs8rgV08ZR0K9fUN3ZCALHCxAnGKANkxsLHvDYPMdrC6QsXFgE:a5bUdildjs8rgVfZLfgZCOHCxAn+D2Mv

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks