Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655
-
Size
680KB
-
Sample
221205-29bqyafh44
-
MD5
9715432d2caa10733530d2d0eb0b2b35
-
SHA1
19cf8b134c8213031346cd14e3a10754a0a49096
-
SHA256
7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655
-
SHA512
647a3ec3e288b0c99a7160a08086bb1dbbc83e3b27303b055f6a4f0392048222dfb00a43c8eef28b945b690a6b0ca39f13f400244ef862b851f213f6cba7a032
-
SSDEEP
12288:0ClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:BOhKpYyB/MrxRAZMES+b+
Malware Config
Targets
-
-
Target
7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655
-
Size
680KB
-
MD5
9715432d2caa10733530d2d0eb0b2b35
-
SHA1
19cf8b134c8213031346cd14e3a10754a0a49096
-
SHA256
7491aff492e44379e3a6b3bacc23978177649c28a7c30c4dcffe2d6d1432b655
-
SHA512
647a3ec3e288b0c99a7160a08086bb1dbbc83e3b27303b055f6a4f0392048222dfb00a43c8eef28b945b690a6b0ca39f13f400244ef862b851f213f6cba7a032
-
SSDEEP
12288:0ClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:BOhKpYyB/MrxRAZMES+b+
Score10/10-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies visiblity of hidden/system files in Explorer
-
Drops file in Drivers directory
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-