Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
gHack-New [20.02.2018] (1)/gHack-New [20.02.2018].exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
gHack-New [20.02.2018] (1)/gHack-New [20.02.2018].exe
Resource
win10v2004-20240426-en
General
-
Target
gHack-New [20.02.2018] (1)/gHack-New [20.02.2018].exe
-
Size
2.9MB
-
MD5
8dc26f22c8817802dd719355a61231a8
-
SHA1
f14cb22b25a2e2bdb50633c143a8ec449e4ad0f7
-
SHA256
ae942b51b7bc6f5d6f81fcab9c905829e89f6942ae2093b8fd864112ce9238a2
-
SHA512
df60734679f3a8382309350b91c87c91cab5417f0216e6ee5452e6c19c6b3fa6c59692bb41e81d223e4c1f500eb82741be6ec922a82cf819ecdc4e6b2b45560f
-
SSDEEP
24576:DiKf6YbusWzi0sBeC2OkmNj+l4wW8YD3m5LWZMkY8Avrb2vcO4z1Pq3+AvIZ:uHYbulTs4C2OPcW/ATyvcO4z1Pq3+AQZ
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Wine gHack-New [20.02.2018].exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Wine gHack-New [20.02.2018].exe Key opened \REGISTRY\MACHINE\Software\Wine gHack-New [20.02.2018].exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1652 gHack-New [20.02.2018].exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1652 gHack-New [20.02.2018].exe 1652 gHack-New [20.02.2018].exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gHack-New [20.02.2018] (1)\gHack-New [20.02.2018].exe"C:\Users\Admin\AppData\Local\Temp\gHack-New [20.02.2018] (1)\gHack-New [20.02.2018].exe"1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1652