Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 03:11
General
-
Target
02199ba87384404792a39113907e64e0.exe
-
Size
3.6MB
-
MD5
02199ba87384404792a39113907e64e0
-
SHA1
af209e88dfb9f47ea7a8fcbb83ca7a7aa07c22ba
-
SHA256
163cf99538e464c106284f002756b4f28a5e10c178eb6949976220e8a9d6b2ee
-
SHA512
f544a0c9e8cae6ae965a376c15b76d8ddebe0ba14953a93c08d8d95d0e730eed69a4a36b94e4af5d8d85b3e9c83358fef42ac4a86c11e1876daf715e6656a8c0
-
SSDEEP
98304:lk/Q8Juk9hG4FP1RRavH/Wyssk7rtIh6Nqa7:l+uqGSc3Hssk7rt5r7
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02199ba87384404792a39113907e64e0.exe"C:\Users\Admin\AppData\Local\Temp\02199ba87384404792a39113907e64e0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161KB
MD5675184bf3b73e80729bbfa93184a2c13
SHA1857fd8c17ca9d9f097e107ab418a59af63506a0b
SHA256d6c827fb7c39d259fa955ae56dc038080a9870b9811b8e4bb15d36523898cdc3
SHA512cf6f5b87c8bd6957ae1f868051181a8b6825b351a462d3f4685f9f86effca2a0dcbd02effbd447ba46dcaffbff1a4d4e80e40e168276e1ec4cafbe1e6933a9c8
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
2.4MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
2.4MB