Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 06:31

General

  • Target

    48446e6f4bbf70897beb6aa9b9e931ea.exe

  • Size

    686KB

  • MD5

    48446e6f4bbf70897beb6aa9b9e931ea

  • SHA1

    f2f54882f41f18c11267e434cd1bedd48e679a94

  • SHA256

    ea146d3285167c8e5005f36ef993ac770de35f8e7d070a3342af261501955988

  • SHA512

    dda31e487cd4a702f16ee41d8df3fb5541db177a0eaf7af718a1fbe7ec10c733d310ecc18d1806c5bebf490bed72695f5923db3121bc832966ecf25db217e8f4

  • SSDEEP

    12288:jLJlYStw/w7efNBwdmb6AecPdhvjDexRKjtpt99Q3jgffYjvO0Xgof:jLJlH2/wqffwAbHdhvoRKnza3cffYjvp

Score
7/10

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1224
      • C:\Users\Admin\AppData\Local\Temp\48446e6f4bbf70897beb6aa9b9e931ea.exe
        "C:\Users\Admin\AppData\Local\Temp\48446e6f4bbf70897beb6aa9b9e931ea.exe"
        2⤵
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1948

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1224-6-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/1224-10-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

      Filesize

      4KB

    • memory/1948-0-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB

    • memory/1948-1-0x0000000003E40000-0x0000000003E42000-memory.dmp

      Filesize

      8KB

    • memory/1948-2-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB

    • memory/1948-4-0x0000000003E30000-0x0000000003E31000-memory.dmp

      Filesize

      4KB

    • memory/1948-3-0x0000000003E50000-0x0000000003E51000-memory.dmp

      Filesize

      4KB

    • memory/1948-8-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/1948-19-0x0000000000400000-0x00000000004A9000-memory.dmp

      Filesize

      676KB