Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
62b6dfea09c6faf2f138e93028451b417f1e656acf0d95da603e3e55983a5d03
-
Size
556KB
-
Sample
221206-rt8qmaac9w
-
MD5
0b99af9b08d52fb3978d2dc51b654a30
-
SHA1
51cf8661fd1a40ba41a73b9b4d22bfa4d574c34e
-
SHA256
62b6dfea09c6faf2f138e93028451b417f1e656acf0d95da603e3e55983a5d03
-
SHA512
07ad28e9f9325e59bf8f2850258d7dad9e74558e9606173b48681e6edce73e3a20a1a75b3db5e71ac84ecd8d9c597e285ba491e589e91cf20d9e3b473904ab15
-
SSDEEP
12288:47Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:47L1yMgcnOds44Fp2PWUDI8
Static task
static1
Behavioral task
behavioral1
Sample
62b6dfea09c6faf2f138e93028451b417f1e656acf0d95da603e3e55983a5d03.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
62b6dfea09c6faf2f138e93028451b417f1e656acf0d95da603e3e55983a5d03.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
62b6dfea09c6faf2f138e93028451b417f1e656acf0d95da603e3e55983a5d03
-
Size
556KB
-
MD5
0b99af9b08d52fb3978d2dc51b654a30
-
SHA1
51cf8661fd1a40ba41a73b9b4d22bfa4d574c34e
-
SHA256
62b6dfea09c6faf2f138e93028451b417f1e656acf0d95da603e3e55983a5d03
-
SHA512
07ad28e9f9325e59bf8f2850258d7dad9e74558e9606173b48681e6edce73e3a20a1a75b3db5e71ac84ecd8d9c597e285ba491e589e91cf20d9e3b473904ab15
-
SSDEEP
12288:47Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:47L1yMgcnOds44Fp2PWUDI8
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-