Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 22:28

General

  • Target

    2f0635cdac8ced40f91aa794cac88c062f082c5540034f5759dc52364419d35a.exe

  • Size

    2.3MB

  • MD5

    8b3a03504221fe53231d4684acbe683f

  • SHA1

    42e206e92d97f5aee25368baab1861e044ad44a2

  • SHA256

    2f0635cdac8ced40f91aa794cac88c062f082c5540034f5759dc52364419d35a

  • SHA512

    f09cbf6225119bc4445a8d4285914e4e6521dbd2b6746d9e7d7180debc3dcd23a5a79f68646dc11ea6f3bd0f318769f4708cf5f3fa5e0759e4eb59f83793b786

  • SSDEEP

    49152:pfNYyhPNfMGphcnhnw0zo7H8W9Kw1Y/17njDlKi6mZ52HMeXhGCt:NXWe4/NwgnjDltF

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f0635cdac8ced40f91aa794cac88c062f082c5540034f5759dc52364419d35a.exe
    "C:\Users\Admin\AppData\Local\Temp\2f0635cdac8ced40f91aa794cac88c062f082c5540034f5759dc52364419d35a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1288-0-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-1-0x00000000775B0000-0x00000000775B2000-memory.dmp

    Filesize

    8KB

  • memory/1288-7-0x0000000000D80000-0x0000000000D81000-memory.dmp

    Filesize

    4KB

  • memory/1288-6-0x0000000001050000-0x0000000001051000-memory.dmp

    Filesize

    4KB

  • memory/1288-8-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

    Filesize

    4KB

  • memory/1288-14-0x0000000000A10000-0x0000000000A11000-memory.dmp

    Filesize

    4KB

  • memory/1288-13-0x0000000000A00000-0x0000000000A02000-memory.dmp

    Filesize

    8KB

  • memory/1288-12-0x0000000001030000-0x0000000001031000-memory.dmp

    Filesize

    4KB

  • memory/1288-11-0x0000000002C50000-0x0000000002C51000-memory.dmp

    Filesize

    4KB

  • memory/1288-10-0x0000000000D00000-0x0000000000D01000-memory.dmp

    Filesize

    4KB

  • memory/1288-9-0x0000000002A70000-0x0000000002A71000-memory.dmp

    Filesize

    4KB

  • memory/1288-5-0x0000000000F10000-0x0000000000F11000-memory.dmp

    Filesize

    4KB

  • memory/1288-4-0x0000000002A50000-0x0000000002A51000-memory.dmp

    Filesize

    4KB

  • memory/1288-3-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

    Filesize

    4KB

  • memory/1288-2-0x0000000000D70000-0x0000000000D71000-memory.dmp

    Filesize

    4KB

  • memory/1288-15-0x0000000002DB0000-0x0000000002DB2000-memory.dmp

    Filesize

    8KB

  • memory/1288-16-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-17-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-18-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-19-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-20-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-21-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-22-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-23-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-24-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-25-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-26-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-27-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-28-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-29-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-30-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB

  • memory/1288-31-0x0000000001060000-0x0000000001648000-memory.dmp

    Filesize

    5.9MB