Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
HBL_2022_790643.doc
-
Size
21KB
-
Sample
220920-efymaabhd9
-
MD5
1bec2ce33fbfac0bae25e2e97f192172
-
SHA1
d7bcee3c070796b2c618415533f57b5d9c48f5be
-
SHA256
7583d99426f32a09f530dc3746df2ccb44aada08f258083565cffe4491f0f6d4
-
SHA512
6b62df7ecbf214a8e000474e36f450eaf84f67aaa8fc32a1f4d5d411c222ea94f0a35625580d926663f7366b92206bde7a1441528aa8c523c20fbd8101f9188d
-
SSDEEP
384:Py+I8QPgKLToFhryQ9JElr+GOilcLdXj1PVq8h7taiw0KIPw:P8++ToFpyQ96/OilcpXjB4u7nw0KIPw
Static task
static1
Behavioral task
behavioral1
Sample
HBL_2022_790643.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HBL_2022_790643.rtf
Resource
win10v2004-20220812-en
Malware Config
Extracted
formbook
tbgn
72uabkWDao+ISa9+tnvd8g==
iHmPX6PZRe2+KUpH8bvyQ68=
DDZrOvw0IT/2cK9sgmSn5Q==
c9nixBxRvLxNBkHR/Q==
Ms/6ydhGJCsp8F8rmWeBMbg=
9vwtEc/074RPygwVx3vJk1Sj6nRnFQ==
3Xy/qN8agnyJQpliwmSqtMLvdQ==
4YelbYl+4fT6sSYguZ3Lhh+rSJQ=
3HSghdAThh2rZPMKqkifKesnqu9orLE=
zwA5DmqaB+VyYuw=
JcUFx6bdrcZbFjWu4rL4
IL7z2C5vtEdYBx/NAYE=
H4+ggrrmXwTFTain36T5
IBEn7UyPK8eER+id9w==
j7LfxdFDOWJlInsaWRhTRMXjLpByHw==
gBsrBXWAXWg9MqYDIug0G+l2k9gQ
432wiJgA7Ox7OsNDexmDtMLvdQ==
fJzoyChf4PQCtyIny2K6jQsBLpByHw==
gLTzwFJTKj3Pds0HC83YDd4h
EKPToXy2sdR1J4bau1KqkwsBLpByHw==
n0BLJ3KkDOVyYuw=
A5nPlJmHABzrW38NWw+DtMLvdQ==
9BxTH7Wokycy5DVybhhEnOdrqM5+Fw==
kkiWfLjpXvGqa2Ju2q7/
0wI+HeSwA5Yg2h9qB5Y=
2JDjt+sZjJhy7S7eS+ZDGu12k9gQ
KSlhQIJNKkzbgtgSBcPYDd4h
bGaca7bpTMpfFXZEznrCN/UgX4U=
rERwSU5CvdCcJ1WUYBVbELA=
gbfrtjlBGBxtZMT+
rqTKqjw1FOOqXb38
x+UL22apWOjw
5w5UNvkwIqFtZMT+
KM4F4yBLpDDBhALXT+NBqJHlYg==
hCSS+ziJPd7p
FEqZa7T/ZAP+SHk4khSFOgExiZw=
X9D94LP20PT+qe6UwVyxtMLvdQ==
GCw9FeUmJLfEcYcE/rX7
ln2PTmTMsAm3gcYO7rvyQ68=
l0NzQEeztM+UhhKb6qQHO8vkLpByHw==
Dy44GvArFjr+b5PVRdVRFLA=
AaLOqCMkCqBtZMT+
PGyohRQXB6BtZMT+
ES5YOkZRuMScVUzY/w==
HsTzufEym0EOdp2qameBMbg=
L8zs12RoSGMsIq4KC8jYDd4h
trjSqAOMsk8biq3c5o4ASxfBCxIc
+xdAIeYQ8BrbUUcSTASB7A==
i4W0n0+Fl14wrg==
udv20NPJH7hA+n9wHa8B/pCg6nRnFQ==
YARZLjhJpUdC/GCwo1vOyEB2k9gQ
UnykcAIQCqptZMT+
bYKQUSJsj2IlpA==
b2Z2WuxhssuJCCaegmSn5Q==
1PQk7bDq2fC9uDmIeAEThgw6d55xFw==
kByfCP0oExxtZMT+
UabfuasX8/7SsjR59ZDQ+axsfQ==
5IObbHdquEbbhtehM+dbAtjwLpByHw==
mhwp/B8igSLkbrcK8LvyQ68=
wu8D4fx4l14wrg==
hfQP4/DqY3hO1jQGkWSqtMLvdQ==
xrDDq3GypdOPftZP+ZA=
zJvbrzWoDaptZMT+
S/gx/Av8UfHCvFIyd2bBg1zqws4J
atm.promo
Extracted
xloader
3.7
tbgn
72uabkWDao+ISa9+tnvd8g==
iHmPX6PZRe2+KUpH8bvyQ68=
DDZrOvw0IT/2cK9sgmSn5Q==
c9nixBxRvLxNBkHR/Q==
Ms/6ydhGJCsp8F8rmWeBMbg=
9vwtEc/074RPygwVx3vJk1Sj6nRnFQ==
3Xy/qN8agnyJQpliwmSqtMLvdQ==
4YelbYl+4fT6sSYguZ3Lhh+rSJQ=
3HSghdAThh2rZPMKqkifKesnqu9orLE=
zwA5DmqaB+VyYuw=
JcUFx6bdrcZbFjWu4rL4
IL7z2C5vtEdYBx/NAYE=
H4+ggrrmXwTFTain36T5
IBEn7UyPK8eER+id9w==
j7LfxdFDOWJlInsaWRhTRMXjLpByHw==
gBsrBXWAXWg9MqYDIug0G+l2k9gQ
432wiJgA7Ox7OsNDexmDtMLvdQ==
fJzoyChf4PQCtyIny2K6jQsBLpByHw==
gLTzwFJTKj3Pds0HC83YDd4h
EKPToXy2sdR1J4bau1KqkwsBLpByHw==
n0BLJ3KkDOVyYuw=
A5nPlJmHABzrW38NWw+DtMLvdQ==
9BxTH7Wokycy5DVybhhEnOdrqM5+Fw==
kkiWfLjpXvGqa2Ju2q7/
0wI+HeSwA5Yg2h9qB5Y=
2JDjt+sZjJhy7S7eS+ZDGu12k9gQ
KSlhQIJNKkzbgtgSBcPYDd4h
bGaca7bpTMpfFXZEznrCN/UgX4U=
rERwSU5CvdCcJ1WUYBVbELA=
gbfrtjlBGBxtZMT+
rqTKqjw1FOOqXb38
x+UL22apWOjw
5w5UNvkwIqFtZMT+
KM4F4yBLpDDBhALXT+NBqJHlYg==
hCSS+ziJPd7p
FEqZa7T/ZAP+SHk4khSFOgExiZw=
X9D94LP20PT+qe6UwVyxtMLvdQ==
GCw9FeUmJLfEcYcE/rX7
ln2PTmTMsAm3gcYO7rvyQ68=
l0NzQEeztM+UhhKb6qQHO8vkLpByHw==
Dy44GvArFjr+b5PVRdVRFLA=
AaLOqCMkCqBtZMT+
PGyohRQXB6BtZMT+
ES5YOkZRuMScVUzY/w==
HsTzufEym0EOdp2qameBMbg=
L8zs12RoSGMsIq4KC8jYDd4h
trjSqAOMsk8biq3c5o4ASxfBCxIc
+xdAIeYQ8BrbUUcSTASB7A==
i4W0n0+Fl14wrg==
udv20NPJH7hA+n9wHa8B/pCg6nRnFQ==
YARZLjhJpUdC/GCwo1vOyEB2k9gQ
UnykcAIQCqptZMT+
bYKQUSJsj2IlpA==
b2Z2WuxhssuJCCaegmSn5Q==
1PQk7bDq2fC9uDmIeAEThgw6d55xFw==
kByfCP0oExxtZMT+
UabfuasX8/7SsjR59ZDQ+axsfQ==
5IObbHdquEbbhtehM+dbAtjwLpByHw==
mhwp/B8igSLkbrcK8LvyQ68=
wu8D4fx4l14wrg==
hfQP4/DqY3hO1jQGkWSqtMLvdQ==
xrDDq3GypdOPftZP+ZA=
zJvbrzWoDaptZMT+
S/gx/Av8UfHCvFIyd2bBg1zqws4J
atm.promo
Targets
-
-
Target
HBL_2022_790643.doc
-
Size
21KB
-
MD5
1bec2ce33fbfac0bae25e2e97f192172
-
SHA1
d7bcee3c070796b2c618415533f57b5d9c48f5be
-
SHA256
7583d99426f32a09f530dc3746df2ccb44aada08f258083565cffe4491f0f6d4
-
SHA512
6b62df7ecbf214a8e000474e36f450eaf84f67aaa8fc32a1f4d5d411c222ea94f0a35625580d926663f7366b92206bde7a1441528aa8c523c20fbd8101f9188d
-
SSDEEP
384:Py+I8QPgKLToFhryQ9JElr+GOilcLdXj1PVq8h7taiw0KIPw:P8++ToFpyQ96/OilcpXjB4u7nw0KIPw
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-