Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.zip
-
Size
7.1MB
-
Sample
230321-rzrz3abc34
-
MD5
4ddcbea7d33bdcee725337fdd85cce4a
-
SHA1
281aa91f44c3738ccac841dc8d3030143a952c97
-
SHA256
bd0a3f94c283fbb440e90ce6d24b145f5f0fdbf71864e97d6e6c549ecb28f08d
-
SHA512
be09c7169d327f24815ee6687a2583c72b07a752f191a85ec87012df20c3906ce736ddc0d11aea9645ac75cab718917edb7e67a3fb54f14521fe86110e896815
-
SSDEEP
196608:g9Cn0aBJ0EqJJoqEZxDPvB7hlIEZ55BcFbpLZSBp+g:g9C0MJ0EOJoqMlllB5WnOp9
Static task
static1
Behavioral task
behavioral1
Sample
00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
laplas
http://212.113.106.172
-
api_key
a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298
Targets
-
-
Target
00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe
-
Size
7.5MB
-
MD5
f5d957a42f578847664cacb8a4c3d695
-
SHA1
5affbea912936570480b7a6a0a7e67c6a2f62ec9
-
SHA256
00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc
-
SHA512
07821df782858665c810e959e92f78de4af56e8d090069c5637537338244f9348f7a878bff95d72620b4c092fd97cfb2d15ffe1c097c36a86399a478ea406980
-
SSDEEP
196608:ZOtzW0BrGc/4GmLcBh8YSZIEqsyZr2caC78:kVW6Gc//B/xEh+a
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-