Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
03/02/2024, 02:08
General
-
Target
8b1da4ef35b8e0dac4de79e5b7873370.exe
-
Size
2.7MB
-
MD5
8b1da4ef35b8e0dac4de79e5b7873370
-
SHA1
5812dfcb7b389abd2156b7880a5ada254c735b70
-
SHA256
fc60dbb549a7bf19f3b96d11efa531360c2e995c9b97e7f6dc7ebfd2b3420598
-
SHA512
2eb158ebdadc47dcbfa47cc08285c2b8ab430a0ed8e5fd720cb4a2a40ea8de38495adfb8634ad6a0e2418250b51f8fad5f1f326770c7688fb451006edd6ed1e3
-
SSDEEP
49152:DX/eb7fi7/L+yMAAFoQRhb9XPHxsDY95EYm30gpkZ74b2DllghO9jA3SA7U:Dmy7/L+yMAKfRhb9XZ1D5mkgpSa2DDgC
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b1da4ef35b8e0dac4de79e5b7873370.exe"C:\Users\Admin\AppData\Local\Temp\8b1da4ef35b8e0dac4de79e5b7873370.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33.8MB
-
Filesize
8KB
-
Filesize
33.8MB