Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 22:45

General

  • Target

    16be509020e7b68a85a3a9e7cc4b15a6.exe

  • Size

    2.1MB

  • MD5

    16be509020e7b68a85a3a9e7cc4b15a6

  • SHA1

    77a21ac7dd7183b4c591fc941484ee17010b13a7

  • SHA256

    8066fba7d65907c2c5305dca716b9a9a3b51fa9a79f54136fb7d0fb8a929e851

  • SHA512

    f4073102758e293534adfd9ec2ae87cbd7b6499a23461af202648acf70b0aa8e5095d9f4ab93e5610781b1ce7dcd575ec7db4f7eaf2bb987b8b947f871feaca3

  • SSDEEP

    49152:LxUsAqJ25gbQwTy9MxxPY5Pkmyg8G3nLLoBf0cvP:+n42ukwTeMxyPkmyWnLcZ0c

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16be509020e7b68a85a3a9e7cc4b15a6.exe
    "C:\Users\Admin\AppData\Local\Temp\16be509020e7b68a85a3a9e7cc4b15a6.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2536-34-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-33-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-32-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-30-0x00000000043B0000-0x00000000043B1000-memory.dmp

    Filesize

    4KB

  • memory/2536-29-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-28-0x0000000004620000-0x0000000004621000-memory.dmp

    Filesize

    4KB

  • memory/2536-27-0x0000000004680000-0x0000000004681000-memory.dmp

    Filesize

    4KB

  • memory/2536-25-0x0000000004670000-0x0000000004671000-memory.dmp

    Filesize

    4KB

  • memory/2536-26-0x00000000046B0000-0x00000000046B1000-memory.dmp

    Filesize

    4KB

  • memory/2536-24-0x00000000043C0000-0x00000000043C1000-memory.dmp

    Filesize

    4KB

  • memory/2536-23-0x00000000046A0000-0x00000000046A1000-memory.dmp

    Filesize

    4KB

  • memory/2536-22-0x0000000004690000-0x0000000004691000-memory.dmp

    Filesize

    4KB

  • memory/2536-21-0x0000000004600000-0x0000000004601000-memory.dmp

    Filesize

    4KB

  • memory/2536-20-0x0000000004560000-0x0000000004561000-memory.dmp

    Filesize

    4KB

  • memory/2536-19-0x00000000045A0000-0x00000000045A1000-memory.dmp

    Filesize

    4KB

  • memory/2536-16-0x0000000004650000-0x0000000004651000-memory.dmp

    Filesize

    4KB

  • memory/2536-18-0x0000000004630000-0x0000000004631000-memory.dmp

    Filesize

    4KB

  • memory/2536-17-0x00000000045C0000-0x00000000045C1000-memory.dmp

    Filesize

    4KB

  • memory/2536-15-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-14-0x0000000004640000-0x0000000004641000-memory.dmp

    Filesize

    4KB

  • memory/2536-13-0x00000000045E0000-0x00000000045E1000-memory.dmp

    Filesize

    4KB

  • memory/2536-12-0x0000000004660000-0x0000000004661000-memory.dmp

    Filesize

    4KB

  • memory/2536-11-0x00000000043D0000-0x00000000043D1000-memory.dmp

    Filesize

    4KB

  • memory/2536-10-0x0000000004610000-0x0000000004611000-memory.dmp

    Filesize

    4KB

  • memory/2536-9-0x00000000043F0000-0x00000000043F2000-memory.dmp

    Filesize

    8KB

  • memory/2536-8-0x0000000004570000-0x0000000004571000-memory.dmp

    Filesize

    4KB

  • memory/2536-7-0x0000000004550000-0x0000000004551000-memory.dmp

    Filesize

    4KB

  • memory/2536-6-0x0000000004590000-0x0000000004591000-memory.dmp

    Filesize

    4KB

  • memory/2536-5-0x00000000045D0000-0x00000000045D1000-memory.dmp

    Filesize

    4KB

  • memory/2536-4-0x00000000043E0000-0x00000000043E1000-memory.dmp

    Filesize

    4KB

  • memory/2536-3-0x0000000004390000-0x0000000004391000-memory.dmp

    Filesize

    4KB

  • memory/2536-1-0x00000000775B0000-0x00000000775B2000-memory.dmp

    Filesize

    8KB

  • memory/2536-0-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-35-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-36-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-37-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-39-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-38-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-40-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-41-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-42-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-43-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-44-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-45-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-46-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-47-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-48-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-49-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-50-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-51-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-52-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB

  • memory/2536-53-0x0000000000400000-0x00000000009B7000-memory.dmp

    Filesize

    5.7MB