Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 12:08

General

  • Target

    7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c.exe

  • Size

    2.5MB

  • MD5

    8c2274264b2797e30d44411bbd36f942

  • SHA1

    31b37127440193b9c8ecabedc214ef51a41b833c

  • SHA256

    7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c

  • SHA512

    376c4e25c9edd8984c7eb6585e2ac7aa6a73b4ab9927f6a65c13431bef5c6a956d11ebdc9e6e9c668ad0bf7352679f38a8c68250c82058d9f75c0d9ac6118c61

  • SSDEEP

    49152:u9hzVlHgIJa177HiK+FcON6s90UoSE+yRiW/6A0d2pJ2j73+e:urLAW4HMz9+XyP2pEv

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Unexpected DNS network traffic destination 7 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c.exe
    "C:\Users\Admin\AppData\Local\Temp\7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4336-0-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-1-0x0000000077684000-0x0000000077686000-memory.dmp

    Filesize

    8KB

  • memory/4336-2-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-6-0x0000000005060000-0x0000000005061000-memory.dmp

    Filesize

    4KB

  • memory/4336-4-0x00000000050A0000-0x00000000050A1000-memory.dmp

    Filesize

    4KB

  • memory/4336-5-0x00000000050B0000-0x00000000050B1000-memory.dmp

    Filesize

    4KB

  • memory/4336-3-0x0000000005090000-0x0000000005091000-memory.dmp

    Filesize

    4KB

  • memory/4336-7-0x0000000005080000-0x0000000005081000-memory.dmp

    Filesize

    4KB

  • memory/4336-8-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-9-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-10-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-11-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-12-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-13-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-14-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-15-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-16-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-17-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-18-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-19-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-20-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-21-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB

  • memory/4336-22-0x00000000009E0000-0x0000000001075000-memory.dmp

    Filesize

    6.6MB