Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2024, 08:06

General

  • Target

    9b29fc2a8a2bfb906480fa8f01ce4743.exe

  • Size

    1.6MB

  • MD5

    9b29fc2a8a2bfb906480fa8f01ce4743

  • SHA1

    3c2a3df7e064d387ce217b9afb834f3e4e002a28

  • SHA256

    1e88014af0a6775373d813a553f4aba72c29ea896b64739b202a0a0f7b0bd2ca

  • SHA512

    55adf17e6b1ff6f90be5497edc7022e4581946cb3d22a643824d3ec1e1083b4accf825c031f458d542eed7ef0b778bcd110c87eb164f18ace81e99d26303d4cf

  • SSDEEP

    49152:Q631PCJ/m/m8iDKC7SsFccbvpTb9t7NgpKb1x:J31D/ziDfSsFccjztpgpW

Score
7/10

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\9b29fc2a8a2bfb906480fa8f01ce4743.exe
        "C:\Users\Admin\AppData\Local\Temp\9b29fc2a8a2bfb906480fa8f01ce4743.exe"
        2⤵
        • Identifies Wine through registry keys
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2208

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1392-4-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

      Filesize

      4KB

    • memory/1392-14-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

      Filesize

      24KB

    • memory/2208-1-0x0000000000740000-0x0000000000889000-memory.dmp

      Filesize

      1.3MB

    • memory/2208-2-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/2208-0-0x0000000000400000-0x000000000073C000-memory.dmp

      Filesize

      3.2MB

    • memory/2208-7-0x00000000043A0000-0x00000000043A2000-memory.dmp

      Filesize

      8KB

    • memory/2208-9-0x00000000008D0000-0x00000000008D1000-memory.dmp

      Filesize

      4KB

    • memory/2208-8-0x0000000000400000-0x000000000073C000-memory.dmp

      Filesize

      3.2MB

    • memory/2208-10-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB