Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 19:38

General

  • Target

    389410755c92f44709da62f5a562bc99.exe

  • Size

    800KB

  • MD5

    389410755c92f44709da62f5a562bc99

  • SHA1

    be8b0117d0d15ccf9363ca749f84ae88b3ef40bc

  • SHA256

    421f271ad2fe37b2c473b349a53d2cae63d7fcdf81a992d13d74b5e82bd0a0fa

  • SHA512

    804c12f11abfa22310ed87f2392bab896463e743a5e6824449012e944feee8d384023c3532daac8406ecbe5c0b9c8d40248557424013e5730e436cb8a53d2de3

  • SSDEEP

    24576:EoDDhviKtGJBpOIvW9mN9iNkOnzbCyLHy+:EoABMmN9i01+

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\389410755c92f44709da62f5a562bc99.exe
    "C:\Users\Admin\AppData\Local\Temp\389410755c92f44709da62f5a562bc99.exe"
    1⤵
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2024
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1264-4-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/1264-8-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

      Filesize

      4KB

    • memory/2024-0-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/2024-1-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/2024-2-0x0000000003FA0000-0x0000000003FA2000-memory.dmp

      Filesize

      8KB

    • memory/2024-3-0x0000000003F90000-0x0000000003F91000-memory.dmp

      Filesize

      4KB

    • memory/2024-7-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2024-17-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB