Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 03:47

General

  • Target

    03c8160a4c98287e4a98717a5a8d6694.exe

  • Size

    3.6MB

  • MD5

    03c8160a4c98287e4a98717a5a8d6694

  • SHA1

    9b1bb1a18013e77372157dae17fff17dea23a68f

  • SHA256

    a95250da40cd5c37eae83026ac499059278843649d01d05a355101fd6c51558f

  • SHA512

    e2010e647ac6c84040e2c7f751a070ed5e1a7d30e60c11add9a78bbcb72a7433e83cdd32b676ac3746520108ee4d2f9338d6506cea6a464be24272dad06f7a96

  • SSDEEP

    98304:lk/Q8Juk9hG4FP1RRavH/Wyssk7rtIh6NqaA:l+uqGSc3Hssk7rt5rA

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03c8160a4c98287e4a98717a5a8d6694.exe
    "C:\Users\Admin\AppData\Local\Temp\03c8160a4c98287e4a98717a5a8d6694.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\iGuyyNozPJ.tmp\htmlayout.dll

    Filesize

    122KB

    MD5

    70a35bc20820c4e92c54e838100fd795

    SHA1

    924bf8b848dcffca412b02d8777f7cdae38b8aaf

    SHA256

    0be549fd983c669fd7d8b10a63cfc41e13affedd166c7c55f8b169d09b64ed26

    SHA512

    22321cec37fc4136c0ed11bc1e2adf9874a9689ff1159bdc7d76e8b8ef3201dde5f45ac47e7e87cdc8706676310afc38cb4e77ebd43c15bf8f4ee057ba78f241

  • memory/3008-0-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-1-0x0000000077020000-0x0000000077022000-memory.dmp

    Filesize

    8KB

  • memory/3008-15-0x00000000048A0000-0x00000000048A1000-memory.dmp

    Filesize

    4KB

  • memory/3008-14-0x0000000004560000-0x0000000004561000-memory.dmp

    Filesize

    4KB

  • memory/3008-13-0x0000000004590000-0x0000000004591000-memory.dmp

    Filesize

    4KB

  • memory/3008-12-0x0000000004540000-0x0000000004541000-memory.dmp

    Filesize

    4KB

  • memory/3008-11-0x0000000004490000-0x0000000004491000-memory.dmp

    Filesize

    4KB

  • memory/3008-10-0x00000000045B0000-0x00000000045B1000-memory.dmp

    Filesize

    4KB

  • memory/3008-9-0x00000000025E0000-0x00000000025E1000-memory.dmp

    Filesize

    4KB

  • memory/3008-8-0x00000000048C0000-0x00000000048C1000-memory.dmp

    Filesize

    4KB

  • memory/3008-7-0x00000000044A0000-0x00000000044A1000-memory.dmp

    Filesize

    4KB

  • memory/3008-6-0x00000000048D0000-0x00000000048D1000-memory.dmp

    Filesize

    4KB

  • memory/3008-5-0x00000000045A0000-0x00000000045A1000-memory.dmp

    Filesize

    4KB

  • memory/3008-4-0x0000000004500000-0x0000000004502000-memory.dmp

    Filesize

    8KB

  • memory/3008-21-0x0000000004960000-0x0000000004961000-memory.dmp

    Filesize

    4KB

  • memory/3008-20-0x0000000004520000-0x0000000004521000-memory.dmp

    Filesize

    4KB

  • memory/3008-19-0x0000000004510000-0x0000000004511000-memory.dmp

    Filesize

    4KB

  • memory/3008-17-0x0000000004570000-0x0000000004571000-memory.dmp

    Filesize

    4KB

  • memory/3008-16-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-3-0x0000000004530000-0x0000000004531000-memory.dmp

    Filesize

    4KB

  • memory/3008-2-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/3008-22-0x0000000004550000-0x0000000004552000-memory.dmp

    Filesize

    8KB

  • memory/3008-26-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB

  • memory/3008-27-0x00000000048F0000-0x00000000048F1000-memory.dmp

    Filesize

    4KB

  • memory/3008-29-0x0000000004900000-0x0000000004901000-memory.dmp

    Filesize

    4KB

  • memory/3008-31-0x0000000004940000-0x0000000004941000-memory.dmp

    Filesize

    4KB

  • memory/3008-32-0x00000000044B0000-0x00000000044B1000-memory.dmp

    Filesize

    4KB

  • memory/3008-30-0x0000000004950000-0x0000000004951000-memory.dmp

    Filesize

    4KB

  • memory/3008-28-0x0000000004910000-0x0000000004911000-memory.dmp

    Filesize

    4KB

  • memory/3008-33-0x0000000004930000-0x0000000004931000-memory.dmp

    Filesize

    4KB

  • memory/3008-34-0x0000000004580000-0x0000000004581000-memory.dmp

    Filesize

    4KB

  • memory/3008-35-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-36-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-37-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB

  • memory/3008-38-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-40-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-42-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-43-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB

  • memory/3008-44-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-46-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-48-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-50-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-52-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-54-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-56-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-58-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-60-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/3008-61-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB

  • memory/3008-62-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB