Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/06/2024, 05:10
General
-
Target
859942e34862a1131e63e36527fc4d7f52f35f320a3070cf16b6718be72e7a54.exe
-
Size
12.5MB
-
MD5
0d8d5a135b8a2c12a460153932e0db94
-
SHA1
c58e1cb0eef586fc9fe076ad8b102b3724390425
-
SHA256
859942e34862a1131e63e36527fc4d7f52f35f320a3070cf16b6718be72e7a54
-
SHA512
91d03d1f46050d86842a75f6baf4e80b98732a6d21d4c136d55fc0a7cf5cedd47a1d01fa7c1ca465354d8e7a48294e279776db3a4ff8c7a264a32a5170a108c8
-
SSDEEP
393216:/KykwrKLFLc6s5XB8ZxxbIZnlvD9t6xpeadML:/+dBLc6s1KxxGlzapeuU
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\859942e34862a1131e63e36527fc4d7f52f35f320a3070cf16b6718be72e7a54.exe"C:\Users\Admin\AppData\Local\Temp\859942e34862a1131e63e36527fc4d7f52f35f320a3070cf16b6718be72e7a54.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.5MB
-
Filesize
12.5MB
-
Filesize
12.5MB
-
Filesize
8.2MB
-
Filesize
2.8MB
-
Filesize
24KB
-
Filesize
152KB
-
Filesize
120KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
816KB
-
Filesize
24KB
-
Filesize
12.5MB