Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
48446e6f4bbf70897beb6aa9b9e931ea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48446e6f4bbf70897beb6aa9b9e931ea.exe
Resource
win10v2004-20231222-en
General
-
Target
48446e6f4bbf70897beb6aa9b9e931ea.exe
-
Size
686KB
-
MD5
48446e6f4bbf70897beb6aa9b9e931ea
-
SHA1
f2f54882f41f18c11267e434cd1bedd48e679a94
-
SHA256
ea146d3285167c8e5005f36ef993ac770de35f8e7d070a3342af261501955988
-
SHA512
dda31e487cd4a702f16ee41d8df3fb5541db177a0eaf7af718a1fbe7ec10c733d310ecc18d1806c5bebf490bed72695f5923db3121bc832966ecf25db217e8f4
-
SSDEEP
12288:jLJlYStw/w7efNBwdmb6AecPdhvjDexRKjtpt99Q3jgffYjvO0Xgof:jLJlH2/wqffwAbHdhvoRKnza3cffYjvp
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Wine 48446e6f4bbf70897beb6aa9b9e931ea.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1224 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe 11 PID 1948 wrote to memory of 1224 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe 11 PID 1948 wrote to memory of 1224 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe 11 PID 1948 wrote to memory of 1224 1948 48446e6f4bbf70897beb6aa9b9e931ea.exe 11
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\48446e6f4bbf70897beb6aa9b9e931ea.exe"C:\Users\Admin\AppData\Local\Temp\48446e6f4bbf70897beb6aa9b9e931ea.exe"2⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
-