Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0eb67e42c017df4483d6c8aeb5ec5960.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0eb67e42c017df4483d6c8aeb5ec5960.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
0eb67e42c017df4483d6c8aeb5ec5960.exe
-
Size
921KB
-
MD5
0eb67e42c017df4483d6c8aeb5ec5960
-
SHA1
235bcde3f0dcf9d25ffaa33b5a61744738ec3b29
-
SHA256
a02098982a854456f72a617fe6eabb5e8343c726fd2da3e7991b034e0be9b1cc
-
SHA512
51880fb5b41eaaf2b9e3cfed2d8aeb74f18efdb29befd3fb76b99fd6c49df412848c1bace489a30b31c50abf165e7b93b197f21f2940dfd4d789525780d02a85
-
SSDEEP
12288:Ks7bVlehF7qoQC5yVaYwtEaoNXGhDGp0WGnA28xdisUIedoziBsNR8RRqyE2uT6a:KwbVlehFenNVrwRoNGhyCWGnAlbotE
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 0eb67e42c017df4483d6c8aeb5ec5960.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 0eb67e42c017df4483d6c8aeb5ec5960.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0eb67e42c017df4483d6c8aeb5ec5960.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0eb67e42c017df4483d6c8aeb5ec5960.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 0eb67e42c017df4483d6c8aeb5ec5960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0eb67e42c017df4483d6c8aeb5ec5960.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2776 2932 WerFault.exe 16 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2776 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 29 PID 2932 wrote to memory of 2776 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 29 PID 2932 wrote to memory of 2776 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 29 PID 2932 wrote to memory of 2776 2932 0eb67e42c017df4483d6c8aeb5ec5960.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eb67e42c017df4483d6c8aeb5ec5960.exe"C:\Users\Admin\AppData\Local\Temp\0eb67e42c017df4483d6c8aeb5ec5960.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 8922⤵
- Program crash
PID:2776
-