Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:22
Behavioral task
behavioral1
Sample
cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe
-
Size
5.1MB
-
MD5
5fff0709172509f29c34878d8fecd346
-
SHA1
68c70307ac1182d7c9711c35574a8330def881c0
-
SHA256
cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3
-
SHA512
3a3495769b9ad0f1d25f73d4317cd4e57b8ce8386f129015b495a1a918690e3aed6cfe5f5aa645b7216e5dcf2a733de8d09957532d1127da468bbd831819afeb
-
SSDEEP
98304:WsZhPs5DXd8UqpNl92eV3VGehLVH/coFZKAJay8sqFRz4j1Jqh9PJ8nrOW:WeqlSUqpNj2YL50wZKaaBz43Y9PuR
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe -
resource yara_rule behavioral1/memory/3036-0-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-2-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-3-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-4-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-5-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-6-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-7-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-8-0x000000013F610000-0x000000014034E000-memory.dmp themida behavioral1/memory/3036-9-0x000000013F610000-0x000000014034E000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3036 cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe"C:\Users\Admin\AppData\Local\Temp\cb5881d774e317c33dc565c487a4c90c528e2bc0b44449e42cdb8698607a17e3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3036