SOFTWrapperforWin9xNTEvaluationVersion

Hunt Hypothesis

This detection identifies the presence of evaluation or trial versions of Windows 9x NT software wrappers that may indicate an adversary leveraging temporary licenses to establish a persistent foothold while evading standard inventory checks. Proactive hunting for this behavior in Azure Sentinel is essential to uncover potentially overlooked legacy components that could serve as vectors for lateral movement or data exfiltration before they are fully integrated into the production environment.

YARA Rule

rule SOFTWrapperforWin9xNTEvaluationVersion
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 8B C5 2D [3] 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SOFTWrapperforWin9xNTEvaluationVersion detection rule in an enterprise environment, along with targeted filters and exclusions:

• Legacy Application Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a legacy Windows 9x-era application (e.g., specialized manufacturing or point-of-sale software) to endpoint machines using Microsoft Endpoint Configuration Manager (SCCM) or Intune. During the installation phase, the installer extracts and executes the SOFTWrapper executable as part of the native evaluation wrapper logic.
  • Filter/Exclusion: Create a path-based exclusion for the specific application’s installation directory (e.g., C:\Program Files\LegacyPOSApp\bin\SOFTWrapper.exe) or exclude processes spawned by ccmsetup.exe and IntuneManagementExtension.exe.

• Scheduled System Health Monitoring Job

  • Scenario: A nightly scheduled task runs a custom diagnostic script to evaluate system compatibility for upcoming OS migrations. This script invokes the SOFT Wrapper tool to generate a report on legacy component health, triggering the rule every time the job executes at 02:00 AM.
  • Filter/Exclusion: Exclude processes where the parent process is TaskScheduler.exe and the command line contains specific keywords like /eval or /report. Alternatively, whitelist the specific scheduled task name (e.g., “LegacyHealthCheck”) in the detection logic.

• Third-Party Antivirus Heuristic Scan

  • Scenario: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a heuristic scan on a known legacy directory containing evaluation binaries. During the scan, the AV engine hooks into the SOFTWrapper process to analyze its behavior, causing the YARA rule to match the wrapper’s