Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 05:14
General
-
Target
6400bb5baddb2d5adfe13fc75e42d060N.exe
-
Size
4.7MB
-
MD5
6400bb5baddb2d5adfe13fc75e42d060
-
SHA1
a59deb27c39e81baa8557860f6bad1812ebefb54
-
SHA256
2269944ef4b75790b297b4aee2c6759a7451a449bec02671651b80c78d42f919
-
SHA512
fd566844a68013b6b53d8913f706b264581bb4ae665632c7abd2a1311288f1b04db2488dfc7423164f8f010e8c2eb835e4a62edc403ea792a5f26739131013df
-
SSDEEP
98304:2hRUJRVOlEYJykc36VeOzRz9zLFEyKnrhS3tO8/5w8+cdibkrXlI9P:AUR6EYRcKVJBtyVS9OU5Gcdi2Xi9P
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6400bb5baddb2d5adfe13fc75e42d060N.exe"C:\Users\Admin\AppData\Local\Temp\6400bb5baddb2d5adfe13fc75e42d060N.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.9MB
-
Filesize
71.8MB
-
Filesize
1.9MB
-
Filesize
71.8MB