Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 19:38
General
-
Target
389410755c92f44709da62f5a562bc99.exe
-
Size
800KB
-
MD5
389410755c92f44709da62f5a562bc99
-
SHA1
be8b0117d0d15ccf9363ca749f84ae88b3ef40bc
-
SHA256
421f271ad2fe37b2c473b349a53d2cae63d7fcdf81a992d13d74b5e82bd0a0fa
-
SHA512
804c12f11abfa22310ed87f2392bab896463e743a5e6824449012e944feee8d384023c3532daac8406ecbe5c0b9c8d40248557424013e5730e436cb8a53d2de3
-
SSDEEP
24576:EoDDhviKtGJBpOIvW9mN9iNkOnzbCyLHy+:EoABMmN9i01+
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\389410755c92f44709da62f5a562bc99.exe"C:\Users\Admin\AppData\Local\Temp\389410755c92f44709da62f5a562bc99.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
76KB
-
Filesize
812KB