Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2024, 05:53

General

  • Target

    f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

  • Size

    1.7MB

  • MD5

    c3d7abe1b3219e62e7afd9be41a71c12

  • SHA1

    e3fbea9da267c6fb01799310d36110b594100d64

  • SHA256

    f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4

  • SHA512

    676dc9202cc85fe7fb4922503547a7940444fdda9a2ebf927841a200673819c31e278e87dd78b865e8fd259aabbe6cea5e6822b08c9ee4aacea413b211a68acd

  • SSDEEP

    49152:jI0Mykez9xO/fbKecU0GwGA9cySrb76c1FC6vS:jIVepxO3bKebHV76cXC

Score
10/10

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
    "C:\Users\Admin\AppData\Local\Temp\f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Windows security modification
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2500-0-0x00000000002C0000-0x000000000071C000-memory.dmp

    Filesize

    4.4MB

  • memory/2500-1-0x0000000077B00000-0x0000000077B02000-memory.dmp

    Filesize

    8KB

  • memory/2500-2-0x00000000762D0000-0x00000000763C0000-memory.dmp

    Filesize

    960KB

  • memory/2500-3-0x00000000761D0000-0x000000007629C000-memory.dmp

    Filesize

    816KB

  • memory/2500-4-0x00000000750E0000-0x000000007512A000-memory.dmp

    Filesize

    296KB

  • memory/2500-5-0x00000000753E0000-0x00000000753E9000-memory.dmp

    Filesize

    36KB

  • memory/2500-6-0x00000000002C0000-0x000000000071C000-memory.dmp

    Filesize

    4.4MB

  • memory/2500-7-0x0000000074970000-0x000000007505E000-memory.dmp

    Filesize

    6.9MB

  • memory/2500-8-0x00000000002C0000-0x000000000071C000-memory.dmp

    Filesize

    4.4MB

  • memory/2500-13-0x00000000750E0000-0x000000007512A000-memory.dmp

    Filesize

    296KB

  • memory/2500-14-0x00000000761D0000-0x000000007629C000-memory.dmp

    Filesize

    816KB

  • memory/2500-12-0x00000000002C0000-0x000000000071C000-memory.dmp

    Filesize

    4.4MB

  • memory/2500-11-0x00000000753E0000-0x00000000753E9000-memory.dmp

    Filesize

    36KB

  • memory/2500-15-0x00000000762D0000-0x00000000763C0000-memory.dmp

    Filesize

    960KB

  • memory/2500-16-0x00000000762D0000-0x00000000763C0000-memory.dmp

    Filesize

    960KB

  • memory/2500-17-0x0000000074970000-0x000000007505E000-memory.dmp

    Filesize

    6.9MB