Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 15:44
Behavioral task
behavioral1
Sample
RealPlayer 15 Crack/rpxiv_activator.exe
Resource
win7-20240215-en
General
-
Target
RealPlayer 15 Crack/rpxiv_activator.exe
-
Size
1.2MB
-
MD5
2d1e99487d499ca8df27ce5c4860e0b2
-
SHA1
59ea896ea0e2d182d777e33582ff8d28624bc752
-
SHA256
80014c8bac5a7e22f43ba2c7395f8b7160e1f2b9394e5c01e0091da61261e59a
-
SHA512
4729e949b7e6f01d97fc6819fa1c589d41b7dce03eaaa33aea362c872fd56880db9be01d8fb334fd1277234783f00458d3ceceddeb0ddeba44c497cf7006619e
-
SSDEEP
24576:Jr1IrN48I3e+TZfqa5PmyWoGl/ORRSUQpy+t4avpveJdcXc4DYEsUS9oe:pmN4dFZia5GpKwRxvkdp4Rq
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine rpxiv_activator.exe -
Loads dropped DLL 1 IoCs
pid Process 1656 rpxiv_activator.exe -
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-1-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-35-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-37-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-39-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-41-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-43-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-45-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-47-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-49-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-51-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-53-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-55-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-57-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-59-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-61-0x0000000000400000-0x00000000006B9000-memory.dmp themida behavioral1/memory/1656-63-0x0000000000400000-0x00000000006B9000-memory.dmp themida -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1656 rpxiv_activator.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1656 rpxiv_activator.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RealPlayer 15 Crack\rpxiv_activator.exe"C:\Users\Admin\AppData\Local\Temp\RealPlayer 15 Crack\rpxiv_activator.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822