Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

tmp.exe

windows7-x64

8

tmp.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    9.5MB

  • Sample

    220923-hhlmaaddd5

  • MD5

    5b0c800dc0a9318659ce511d96f83e31

  • SHA1

    666709ec97b6742b5bdc4b425333a14ac383f12e

  • SHA256

    9aabdf426620b16358bb48ce7ef0f92e5343715f78e4a35d8733beff57ca497d

  • SHA512

    acb1a644100a59a68348ba6e45e98bf5d3e8021573ddef2148a923c31fe6ba218b3cfe8b86db9c48d89ad0bd92c9bb4be5b837bdbd0f9710e5e39696c39a0a45

  • SSDEEP

    196608:tLSbvETcxNk4BMWT+4iBjMfj5WMinMqIDoYUR8QPPQGoZPIe625DL7RaorV:tspepc0BjMLZinMqejE3eFIxwL9aoJ

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      tmp

    • Size

      9.5MB

    • MD5

      5b0c800dc0a9318659ce511d96f83e31

    • SHA1

      666709ec97b6742b5bdc4b425333a14ac383f12e

    • SHA256

      9aabdf426620b16358bb48ce7ef0f92e5343715f78e4a35d8733beff57ca497d

    • SHA512

      acb1a644100a59a68348ba6e45e98bf5d3e8021573ddef2148a923c31fe6ba218b3cfe8b86db9c48d89ad0bd92c9bb4be5b837bdbd0f9710e5e39696c39a0a45

    • SSDEEP

      196608:tLSbvETcxNk4BMWT+4iBjMfj5WMinMqIDoYUR8QPPQGoZPIe625DL7RaorV:tspepc0BjMLZinMqejE3eFIxwL9aoJ

    Score
    8/10
    persistencevmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks