Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.zip
-
Size
7.2MB
-
Sample
230321-rzvqysbc37
-
MD5
d9ec35fb5788246eceddf36acb62d041
-
SHA1
5830f3a6b5964b82e5092bb4600525a50b59956d
-
SHA256
f8918613f0ff3b2f7e97653c6c94cef0cb22275e3f9b05bf5aa44ad2bdeabfec
-
SHA512
1730c732c79beef2968946d524750c4d6959b96da2e6fc37953d75fc27247cf92c97c042bc3ac5f0bd234a1673bacf828089775020a4dba537d666fd6dcb2c15
-
SSDEEP
196608:anysdiMHCEKwYK86qYMMvH1mpdTs35LJ/+ronVb6M:anjdfiEvOYO5spLJJVb6M
Static task
static1
Behavioral task
behavioral1
Sample
348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
laplas
http://185.106.92.104
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Targets
-
-
Target
348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe
-
Size
7.3MB
-
MD5
99f16ab6ab670935b5aa5c84b1b5f6bd
-
SHA1
59f375481cdfe246d1ddcaada9941e16dcfda297
-
SHA256
348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057
-
SHA512
845e76e29adb6b7890a3a5c508e27b9731e9872bc791eeefb146b23e0e737280d19e4df1203b719f8e168a8c8a0d8ae1b4bf670da5d264bde1eece8663624d70
-
SSDEEP
196608:Ltu5ODXM16mjmKSRFWuxx6ruj3nK/x9jWuy:L05ODcgR6mix1
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-