97ba4422534cfd514e9dff46d3fb40efeb33ed2ad0ab29dee8a312453049203d | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

PO_Scan Document.exe

windows7-x64

7

PO_Scan Document.exe

windows10-2004-x64

7

Sharing

General

Target

PO_Scan Document.exe
Size

433KB
Sample

230403-gm2nmada93
MD5

e3f21a7a4a879db45f6e3feeb8d43c5e
SHA1

2d198951d904596d300933714f24acdcc796fe77
SHA256

97ba4422534cfd514e9dff46d3fb40efeb33ed2ad0ab29dee8a312453049203d
SHA512

5db796f7fe1574646c3de6cabf022eca4db30155f9120c37f73e92e485c5b09e4664bb8a254332474c35a0c4ea3d5ff9ed5f8a74fdea0f3ed4b420c9a0d77288
SSDEEP

6144:vYa6T3YS/vfoY2wXVVfY5Pv8wsD9QkiF2VIBn1AyxhOiMshL3Qlk1OkoyoV3OCcn:vY5XswlVfmPs+ktIB1T7vhhn4Fr+CYt

Score

7^/10

Static task

static1

Behavioral task

behavioral1

Sample

PO_Scan Document.exe

Resource

win7-20230220-en

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

PO_Scan Document.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  PO_Scan Document.exe
- Size
  
  433KB
- MD5
  
  e3f21a7a4a879db45f6e3feeb8d43c5e
- SHA1
  
  2d198951d904596d300933714f24acdcc796fe77
- SHA256
  
  97ba4422534cfd514e9dff46d3fb40efeb33ed2ad0ab29dee8a312453049203d
- SHA512
  
  5db796f7fe1574646c3de6cabf022eca4db30155f9120c37f73e92e485c5b09e4664bb8a254332474c35a0c4ea3d5ff9ed5f8a74fdea0f3ed4b420c9a0d77288
- SSDEEP
  
  6144:vYa6T3YS/vfoY2wXVVfY5Pv8wsD9QkiF2VIBn1AyxhOiMshL3Qlk1OkoyoV3OCcn:vY5XswlVfmPs+ktIB1T7vhhn4Fr+CYt
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

© 2018-2025

Terms | Privacy