Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 19:24

General

  • Target

    virussign.com_9cfe18ad858015c7e20739978a185660.exe

  • Size

    4.3MB

  • MD5

    9cfe18ad858015c7e20739978a185660

  • SHA1

    8902933058d4b915a6a66b78679a01f32cbd4d13

  • SHA256

    38ac7e5e10f98bb4dc3ae4b1e88a2766a7eabcb3750c1d09bdad8ad58088c8f1

  • SHA512

    70bc5fb5a6e76ae12b6327c6c31630280c4e75bfa33f4e906a31eecd21f170b6ff987c4c7dd62d5fe0a648e131d8bae7c018a204c2af79be8faaec6324f31933

  • SSDEEP

    98304:kf4EIDDHK9nhCbJzEaokXvLZw8jzcO/7KNQS8r7NL5j5tDo3STwK7zUFBVEWLUy:Q4HKDQBKkXy+XWt815j5tDobSUFQsL

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\virussign.com_9cfe18ad858015c7e20739978a185660.exe
    "C:\Users\Admin\AppData\Local\Temp\virussign.com_9cfe18ad858015c7e20739978a185660.exe"
    1⤵
    • Checks BIOS information in registry
    • Enumerates connected drives
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:3244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3244-0-0x0000000000400000-0x0000000000CB9000-memory.dmp

    Filesize

    8.7MB

  • memory/3244-1-0x0000000001120000-0x0000000001123000-memory.dmp

    Filesize

    12KB

  • memory/3244-4-0x0000000000401000-0x000000000053D000-memory.dmp

    Filesize

    1.2MB

  • memory/3244-3-0x0000000000400000-0x0000000000CB9000-memory.dmp

    Filesize

    8.7MB

  • memory/3244-2-0x0000000000400000-0x0000000000CB9000-memory.dmp

    Filesize

    8.7MB

  • memory/3244-5-0x0000000000400000-0x0000000000CB9000-memory.dmp

    Filesize

    8.7MB

  • memory/3244-6-0x0000000000400000-0x0000000000CB9000-memory.dmp

    Filesize

    8.7MB

  • memory/3244-7-0x0000000000400000-0x0000000000CB9000-memory.dmp

    Filesize

    8.7MB

  • memory/3244-8-0x0000000000401000-0x000000000053D000-memory.dmp

    Filesize

    1.2MB