Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5f7bc91a902a27af743b1d1fe07fd9a0b7fb7067d059a4ada5d76d0b35ee7aa9
-
Size
146KB
-
Sample
221203-bx6sfaga6y
-
MD5
4d6032603ea1f4769812deb05f24e4a0
-
SHA1
6438b61008cd44a5276dd9216a70c87affa3f741
-
SHA256
5f7bc91a902a27af743b1d1fe07fd9a0b7fb7067d059a4ada5d76d0b35ee7aa9
-
SHA512
2b3f11aabe31f0117691eb480a4773e372e5e1603876b238d3d7106e5c8d4cfa829ec51f80a98a214b493d28c3afe5f4aa95cfe250c8ef9d200f131f922b5303
-
SSDEEP
3072:pZ4whCoTh9z3QGEU0pt+PVTNYy7yrHMjUqmF9lA1Uf3PZ:pFEUXzmPpt+PVR9XqrZ3R
Static task
static1
Behavioral task
behavioral1
Sample
5f7bc91a902a27af743b1d1fe07fd9a0b7fb7067d059a4ada5d76d0b35ee7aa9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5f7bc91a902a27af743b1d1fe07fd9a0b7fb7067d059a4ada5d76d0b35ee7aa9.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
5f7bc91a902a27af743b1d1fe07fd9a0b7fb7067d059a4ada5d76d0b35ee7aa9
-
Size
146KB
-
MD5
4d6032603ea1f4769812deb05f24e4a0
-
SHA1
6438b61008cd44a5276dd9216a70c87affa3f741
-
SHA256
5f7bc91a902a27af743b1d1fe07fd9a0b7fb7067d059a4ada5d76d0b35ee7aa9
-
SHA512
2b3f11aabe31f0117691eb480a4773e372e5e1603876b238d3d7106e5c8d4cfa829ec51f80a98a214b493d28c3afe5f4aa95cfe250c8ef9d200f131f922b5303
-
SSDEEP
3072:pZ4whCoTh9z3QGEU0pt+PVTNYy7yrHMjUqmF9lA1Uf3PZ:pFEUXzmPpt+PVR9XqrZ3R
Score10/10-
Modifies visiblity of hidden/system files in Explorer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious use of SetThreadContext
-