Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19/09/2022, 07:36
General
-
Target
b114e2770bde0b186ad373d02811147675c8150a7c71da7fd4d5ba62670da8e9.exe
-
Size
40KB
-
MD5
c9de3f2c08b4694003969bb81115bbeb
-
SHA1
34e5309088ea1ddd2d672ef3680db42f34205e93
-
SHA256
b114e2770bde0b186ad373d02811147675c8150a7c71da7fd4d5ba62670da8e9
-
SHA512
3f7aae2357b371e422bccfd547a068e72c77b287e0d4e00ee14e18cd64d4f85ea8f097f05aa845ebb1f19f4c25fd2e74b21976e5b10e031bda135624cf09ad4a
-
SSDEEP
768:vCyCz4qgjgROK73CXX9n0+Dc29Q84fd41jrM5Hguqnm/cVi5:qlhJzktn0+vslCjoGi5
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b114e2770bde0b186ad373d02811147675c8150a7c71da7fd4d5ba62670da8e9.exe"C:\Users\Admin\AppData\Local\Temp\b114e2770bde0b186ad373d02811147675c8150a7c71da7fd4d5ba62670da8e9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx