Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Doc065754.lnk.7z
-
Size
594B
-
Sample
230310-r1hssafh8w
-
MD5
5faa0c0239706391fbc29e0eeebdb8e5
-
SHA1
a6741ed98250a7bb55e5c593d0298a158af94a57
-
SHA256
0d7937b2bf3813bb8b22e7d7c3f85ffc8638fd6da6b50a2e4eed480a964b46db
-
SHA512
134179825c3b7238d46b762ab47c65d3171e0ac090eb2dc61ad50ce099a8dd0cbab38647e71fd8288d2ed5d7a3046839141c3a8e34ffa1fa4c3845c56d8ed18b
Static task
static1
Behavioral task
behavioral1
Sample
Doc065754.lnk
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Doc065754.lnk
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
Doc065754.lnk
-
Size
2KB
-
MD5
f4aa46ca2856c7f137ca9e95b255c001
-
SHA1
a71f7cec83d329c3444dcc9cf53181689ac02227
-
SHA256
86a3eea0abb10bdcac6a00b9bdf1d76a408fbdd27db8be389757e069a2855f11
-
SHA512
e207a15a14acdfd40e6edbff9d96f2e8a460e954768da45d6d5de3a78fec04a5758261a92f3696a694fa7fba55faf0fbc1222d7276e3bc238723e3321556093a
Score10/10-
Blocklisted process makes network request
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-