Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c1ea0dedf40b080e43e7ee8f75f4093cdfb356635d554e7f8a9064e06cbc6a96
-
Size
108KB
-
Sample
221204-mltjhsah55
-
MD5
ee801b5254642cc0376687f9b0e04c7b
-
SHA1
a823276b1a32d606eb581d6b69b2bd09a383ef30
-
SHA256
c1ea0dedf40b080e43e7ee8f75f4093cdfb356635d554e7f8a9064e06cbc6a96
-
SHA512
23afc4380f27a62336fb64002855d66868d8e7adbabc1e78847745b39845986dd5806f35e3cac5253c141950b7b8e4f6f8bc9f244e2c7d99ede5a05afce186ba
-
SSDEEP
3072:vvgdpmgumQlGpD/53Sq5iDkReAoqFysV19HW+:vvgHTMGxB3cOeAJI4HW+
Static task
static1
Behavioral task
behavioral1
Sample
PHOTO-DEVOCHKA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PHOTO-DEVOCHKA.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
PHOTO-DEVOCHKA.exe
-
Size
167KB
-
MD5
ef228a906001229e469f7b61f89a0481
-
SHA1
d7bdedbf34f268353ef139e90455c9bfedbe5b25
-
SHA256
cd739c5a166fcea3510d2ab393e64da1ed3956cf19082258ec383e94b12baa52
-
SHA512
f191afd9e1059e4595a08ace41c65d2820ae6643a40e3c6877d6665462046cd7c8e0c3ff9a990fdad5912b663945f148787ac358c7b86d790e497a6acc2c45fa
-
SSDEEP
3072:mBAp5XhKpN4eOyVTGfhEClj8jTk+0hAy8nnDFysV19HWn:dbXE9OiTGfhEClq928nnDI4HWn
Score8/10-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-