Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

c26c707108...97.exe

windows7-x64

10

c26c707108...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c26c7071083d117b51f4a73fab2f8697.exe

  • Size

    33.9MB

  • Sample

    230106-vp9nxada2v

  • MD5

    c26c7071083d117b51f4a73fab2f8697

  • SHA1

    9168db21aac302514e9491101063acfabcdbec2e

  • SHA256

    7e744136336ec22c55586bcd75d19897ecc78a58eebe836ad0147a7861bc32f3

  • SHA512

    29e2a3f9174852eea6fe6ffe09a8b380eb138420c568f307089406baedcc5cec4c07f64cf60673d0e54fae3bc3724125b050209e8873dc77f0b08b2a933424e7

  • SSDEEP

    786432:R7OnqnMHIl8tC//mjepEvxfsqwhEfJO3WvmBqz:R6nqwg8tKuTxfEh6xmo

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://135.181.123.26/sccp32.dll

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://135.181.123.26/rundll32.bat

Targets

    • Target

      c26c7071083d117b51f4a73fab2f8697.exe

    • Size

      33.9MB

    • MD5

      c26c7071083d117b51f4a73fab2f8697

    • SHA1

      9168db21aac302514e9491101063acfabcdbec2e

    • SHA256

      7e744136336ec22c55586bcd75d19897ecc78a58eebe836ad0147a7861bc32f3

    • SHA512

      29e2a3f9174852eea6fe6ffe09a8b380eb138420c568f307089406baedcc5cec4c07f64cf60673d0e54fae3bc3724125b050209e8873dc77f0b08b2a933424e7

    • SSDEEP

      786432:R7OnqnMHIl8tC//mjepEvxfsqwhEfJO3WvmBqz:R6nqwg8tKuTxfEh6xmo

    Score
    10/10

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks