Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 03:47

General

  • Target

    03c8160a4c98287e4a98717a5a8d6694.exe

  • Size

    3.6MB

  • MD5

    03c8160a4c98287e4a98717a5a8d6694

  • SHA1

    9b1bb1a18013e77372157dae17fff17dea23a68f

  • SHA256

    a95250da40cd5c37eae83026ac499059278843649d01d05a355101fd6c51558f

  • SHA512

    e2010e647ac6c84040e2c7f751a070ed5e1a7d30e60c11add9a78bbcb72a7433e83cdd32b676ac3746520108ee4d2f9338d6506cea6a464be24272dad06f7a96

  • SSDEEP

    98304:lk/Q8Juk9hG4FP1RRavH/Wyssk7rtIh6NqaA:l+uqGSc3Hssk7rt5rA

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03c8160a4c98287e4a98717a5a8d6694.exe
    "C:\Users\Admin\AppData\Local\Temp\03c8160a4c98287e4a98717a5a8d6694.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\PixObv4nTx.tmp\htmlayout.dll

    Filesize

    226KB

    MD5

    72bf6a78d35304df3be450237bdcd6a6

    SHA1

    fd398372ac6b8a027a67a62bdc75345654da30be

    SHA256

    134066ee71a7424b8443084f88839a2a61e71709716483d96178b1f7530070ad

    SHA512

    353f5090b7e79187e2d77dbf6c5cec58f382d5c9fc565ebbc54f5539086f5ed0479a6966ca66a6a24e6406a81f66ab80e19acd28d68df9ed082cecad00a5ee1d

  • memory/4204-7-0x0000000004E50000-0x0000000004E51000-memory.dmp

    Filesize

    4KB

  • memory/4204-5-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

    Filesize

    4KB

  • memory/4204-4-0x0000000004E60000-0x0000000004E61000-memory.dmp

    Filesize

    4KB

  • memory/4204-1-0x0000000077EA4000-0x0000000077EA6000-memory.dmp

    Filesize

    8KB

  • memory/4204-25-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB

  • memory/4204-29-0x0000000004F60000-0x0000000004F61000-memory.dmp

    Filesize

    4KB

  • memory/4204-28-0x0000000004F70000-0x0000000004F71000-memory.dmp

    Filesize

    4KB

  • memory/4204-27-0x0000000004F30000-0x0000000004F31000-memory.dmp

    Filesize

    4KB

  • memory/4204-26-0x0000000004F20000-0x0000000004F21000-memory.dmp

    Filesize

    4KB

  • memory/4204-20-0x0000000004F80000-0x0000000004F81000-memory.dmp

    Filesize

    4KB

  • memory/4204-19-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

    Filesize

    4KB

  • memory/4204-18-0x0000000004E90000-0x0000000004E91000-memory.dmp

    Filesize

    4KB

  • memory/4204-17-0x0000000004F90000-0x0000000004F91000-memory.dmp

    Filesize

    4KB

  • memory/4204-16-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

    Filesize

    4KB

  • memory/4204-15-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

    Filesize

    4KB

  • memory/4204-12-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-10-0x0000000004E80000-0x0000000004E81000-memory.dmp

    Filesize

    4KB

  • memory/4204-9-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

    Filesize

    4KB

  • memory/4204-8-0x0000000004F10000-0x0000000004F11000-memory.dmp

    Filesize

    4KB

  • memory/4204-0-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-11-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

    Filesize

    4KB

  • memory/4204-6-0x0000000004F00000-0x0000000004F01000-memory.dmp

    Filesize

    4KB

  • memory/4204-13-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

    Filesize

    4KB

  • memory/4204-3-0x0000000004E70000-0x0000000004E71000-memory.dmp

    Filesize

    4KB

  • memory/4204-2-0x0000000004E40000-0x0000000004E41000-memory.dmp

    Filesize

    4KB

  • memory/4204-30-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-31-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB

  • memory/4204-32-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-33-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-35-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-37-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-39-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-41-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-43-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-45-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-47-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-49-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-51-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-53-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-55-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-57-0x0000000000400000-0x0000000000A93000-memory.dmp

    Filesize

    6.6MB

  • memory/4204-58-0x0000000010000000-0x0000000010269000-memory.dmp

    Filesize

    2.4MB