Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
94b9a662f8f42a25d8546d8e92da803e.exe
-
Size
164KB
-
Sample
230311-3hkp7sdg7t
-
MD5
94b9a662f8f42a25d8546d8e92da803e
-
SHA1
030940062e7def70b69b4c1c93fc4eaa44449f0f
-
SHA256
e02f76cba9aa4e7c1c8de333af719bcf18e2dfb216b7f363b00e64bfde79616b
-
SHA512
185fbc5da3ea6df42e7e26966acbe904d922114e5d32769e237d8d562d7a08ffbe20d794ddc42a4cbf88948d77818eb166641bc7235ecd30775e1c6f8549a65b
-
SSDEEP
3072:FEwE/wam2GFzsw2PTWEc0FIEb9ik5E4I3:FETfLF5FbH3I3
Behavioral task
behavioral1
Sample
94b9a662f8f42a25d8546d8e92da803e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
94b9a662f8f42a25d8546d8e92da803e.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
94b9a662f8f42a25d8546d8e92da803e.exe
-
Size
164KB
-
MD5
94b9a662f8f42a25d8546d8e92da803e
-
SHA1
030940062e7def70b69b4c1c93fc4eaa44449f0f
-
SHA256
e02f76cba9aa4e7c1c8de333af719bcf18e2dfb216b7f363b00e64bfde79616b
-
SHA512
185fbc5da3ea6df42e7e26966acbe904d922114e5d32769e237d8d562d7a08ffbe20d794ddc42a4cbf88948d77818eb166641bc7235ecd30775e1c6f8549a65b
-
SSDEEP
3072:FEwE/wam2GFzsw2PTWEc0FIEb9ik5E4I3:FETfLF5FbH3I3
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-