Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
338772a06063206d1826ed4a3e7a3fed9a3e5861eaecc8294744f020fedd5908
-
Size
88KB
-
Sample
221204-rmvkesbc7x
-
MD5
3bc920804237f0102274d43879196de0
-
SHA1
3d8a582c2107118a28e46a8e2706a59d9197124f
-
SHA256
338772a06063206d1826ed4a3e7a3fed9a3e5861eaecc8294744f020fedd5908
-
SHA512
7bf65dd0bf36aee34e591806c350e4ba2a4c18c6aff390924b75c9f030a7059bc4c95bdb360ebf71ccbaaba8cdfe58e1c0391a8c151d674e4d0f09a12347b904
-
SSDEEP
1536:VjCw5wIlo3FMWQprwSq3lOTnl9qdgHKa3qGp2iL1S9BfTaosZ8lj:AIOfQprVWYTmG3qGsiL1OBf88lj
Malware Config
Targets
-
-
Target
338772a06063206d1826ed4a3e7a3fed9a3e5861eaecc8294744f020fedd5908
-
Size
88KB
-
MD5
3bc920804237f0102274d43879196de0
-
SHA1
3d8a582c2107118a28e46a8e2706a59d9197124f
-
SHA256
338772a06063206d1826ed4a3e7a3fed9a3e5861eaecc8294744f020fedd5908
-
SHA512
7bf65dd0bf36aee34e591806c350e4ba2a4c18c6aff390924b75c9f030a7059bc4c95bdb360ebf71ccbaaba8cdfe58e1c0391a8c151d674e4d0f09a12347b904
-
SSDEEP
1536:VjCw5wIlo3FMWQprwSq3lOTnl9qdgHKa3qGp2iL1S9BfTaosZ8lj:AIOfQprVWYTmG3qGsiL1OBf88lj
Score10/10-
Modifies visiblity of hidden/system files in Explorer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious use of SetThreadContext
-