Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Doc065754.lnk

windows7-x64

3

Doc065754.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Doc065754.lnk.7z

  • Size

    594B

  • Sample

    230310-r1hssafh8w

  • MD5

    5faa0c0239706391fbc29e0eeebdb8e5

  • SHA1

    a6741ed98250a7bb55e5c593d0298a158af94a57

  • SHA256

    0d7937b2bf3813bb8b22e7d7c3f85ffc8638fd6da6b50a2e4eed480a964b46db

  • SHA512

    134179825c3b7238d46b762ab47c65d3171e0ac090eb2dc61ad50ce099a8dd0cbab38647e71fd8288d2ed5d7a3046839141c3a8e34ffa1fa4c3845c56d8ed18b

Score
10/10
guloaderdownloaderpersistence

Malware Config

Targets

    • Target

      Doc065754.lnk

    • Size

      2KB

    • MD5

      f4aa46ca2856c7f137ca9e95b255c001

    • SHA1

      a71f7cec83d329c3444dcc9cf53181689ac02227

    • SHA256

      86a3eea0abb10bdcac6a00b9bdf1d76a408fbdd27db8be389757e069a2855f11

    • SHA512

      e207a15a14acdfd40e6edbff9d96f2e8a460e954768da45d6d5de3a78fec04a5758261a92f3696a694fa7fba55faf0fbc1222d7276e3bc238723e3321556093a

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks