Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
8b1da4ef35b8e0dac4de79e5b7873370.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8b1da4ef35b8e0dac4de79e5b7873370.exe
Resource
win10v2004-20231222-en
General
-
Target
8b1da4ef35b8e0dac4de79e5b7873370.exe
-
Size
2.7MB
-
MD5
8b1da4ef35b8e0dac4de79e5b7873370
-
SHA1
5812dfcb7b389abd2156b7880a5ada254c735b70
-
SHA256
fc60dbb549a7bf19f3b96d11efa531360c2e995c9b97e7f6dc7ebfd2b3420598
-
SHA512
2eb158ebdadc47dcbfa47cc08285c2b8ab430a0ed8e5fd720cb4a2a40ea8de38495adfb8634ad6a0e2418250b51f8fad5f1f326770c7688fb451006edd6ed1e3
-
SSDEEP
49152:DX/eb7fi7/L+yMAAFoQRhb9XPHxsDY95EYm30gpkZ74b2DllghO9jA3SA7U:Dmy7/L+yMAKfRhb9XZ1D5mkgpSa2DDgC
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8b1da4ef35b8e0dac4de79e5b7873370.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8b1da4ef35b8e0dac4de79e5b7873370.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8b1da4ef35b8e0dac4de79e5b7873370.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Wine 8b1da4ef35b8e0dac4de79e5b7873370.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2304 8b1da4ef35b8e0dac4de79e5b7873370.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2304 8b1da4ef35b8e0dac4de79e5b7873370.exe 2304 8b1da4ef35b8e0dac4de79e5b7873370.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b1da4ef35b8e0dac4de79e5b7873370.exe"C:\Users\Admin\AppData\Local\Temp\8b1da4ef35b8e0dac4de79e5b7873370.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2304