Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2023, 03:50

General

  • Target

    feedae4200a73b606c862f5665b3c75c.exe

  • Size

    5.0MB

  • MD5

    feedae4200a73b606c862f5665b3c75c

  • SHA1

    5dcb4cb17f46e01da4b17a3b53fc5d86edf1bf1e

  • SHA256

    7a317a588f9dda54702d316bdacb84d641e7ba403d3d71b009a55aafdae61657

  • SHA512

    41580b5cd2412986dd92a8822a117698cb41f8d4656dfb8bd0ba6251fd3065b6d8ad3213173f51e4516550804bea079517d441cea1580dfd9bde4836bee33700

  • SSDEEP

    98304:kB3MEFDrhzYlUK1U1rKNo2QR0dpsYuM9jFs+fqISACgMb2Ti5kou6lqK:kB31V8lU5KN+R0kYuM9BNfqd1Jwi5kHc

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\feedae4200a73b606c862f5665b3c75c.exe
    "C:\Users\Admin\AppData\Local\Temp\feedae4200a73b606c862f5665b3c75c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1864-0-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-1-0x0000000076DE0000-0x0000000076F89000-memory.dmp

    Filesize

    1.7MB

  • memory/1864-2-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-3-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-4-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-5-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-6-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-7-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-8-0x000000013FB10000-0x00000001407F7000-memory.dmp

    Filesize

    12.9MB

  • memory/1864-9-0x0000000076DE0000-0x0000000076F89000-memory.dmp

    Filesize

    1.7MB