Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
89s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
14/07/2024, 08:50
General
-
Target
f8e1b68248848fbbd74402ad9129ffb4.exe
-
Size
18.5MB
-
MD5
12d9255227567a75ef9e064e84ef62bd
-
SHA1
93ff56e0565e69e42f93e85bcc3b844d48156006
-
SHA256
7d2c6a9bd728bbcc103b49956bf49efc4796acb1cfba6776cbf2e0cc0414c0b1
-
SHA512
73ff67b61613bd2d0557768266076ab9d2dea9964ee5ff7e32fc46752cc51f54b833a7d9a0d4c5e3cc23f9576d4955d7c3eca5e59b9817578f08f01b0a9ee1c3
-
SSDEEP
393216:uSLpLFG0zW0zkV8GP870Qj3+thpvLpTWwim72/kpW8wxUm:uSLBz1ABUj3+vpvLpTLim7KiQl
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e1b68248848fbbd74402ad9129ffb4.exe"C:\Users\Admin\AppData\Local\Temp\f8e1b68248848fbbd74402ad9129ffb4.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB
-
Filesize
49.6MB