Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
QUOTE REQUEST 047855273660.exe
-
Size
725KB
-
Sample
230710-ll5q4sae71
-
MD5
065cf92b7519116b3cbb416e7d31dfba
-
SHA1
706b218470e606e34d6605b6ed776f67c35efc94
-
SHA256
091305d3595b7324e7fb674b6120cdb142a6196e796f890fd625e76a014211e8
-
SHA512
588e33825a813d9ed577e76c8926246633886b6f653f5ddc6f515c16fffbf5438018ba71eb720251d3d53bde1a780acdeb3723148ee6b8604cc168375b451f37
-
SSDEEP
6144:/Jepo8KR2VeL6CIVNcCCBxvIM+PBJUWaYh08H+xxPC8ZhG1xVaqklq5LTyrHsVfm:amZQVtY9GA/4QWM723tlC1tRX0po/9D
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE REQUEST 047855273660.exe
Resource
win7-20230703-en
Malware Config
Extracted
formbook
4.1
jy95
do-si-dough.com
cchapmanganato.com
04it.icu
kawebdesign.site
oasisconnects.com
op091.com
psychicstandupcomedy.com
harveylee.online
x55568.com
orbinlopez.one
45745931.buzz
undiereleaseco.com
cludybot.net
sailtmtbar.com
siennashih.com
premintxyz.net
xn--bj4bt9j.com
giornalaiditalia.com
colorfullemonade.com
baddiebearz.com
xbkgstd.top
codecultr.com
muenols.xyz
creditors.online
xn--tecnologahbrida-cpbc.com
gotmot.com
physiowithamina.com
smartshoppinghub.store
magis-bo.com
ebayqerbaf.top
hospitalmode.com
strydasoles.store
savvieseller.com
arketha.com
biotherm159.online
fiveclost.sbs
nicholasthemarketer.com
coinpod.app
kassel-strafrecht.com
bbcbcb555.online
voxlinx.online
afm.ventures
yiniao.site
mrsmacksshortbread.com
crashcoursechatgpt.com
fetus.fun
forumconstructioninc.com
finanzas1.com
ussinners.com
conservingjudaism.live
surferscompass.com
blacklifecoachcompany.com
awadhsamachar.com
geektechtalks.com
cryptubank.accountants
hzqywzhs.com
kendradoggrooming.com
isbuae.com
taiyienergyhealing.com
oficial-site-promocao.com
parfermelha.store
digitalshop.biz
crackmyway.com
bretanastore.com
sassnass.com
Targets
-
-
Target
QUOTE REQUEST 047855273660.exe
-
Size
725KB
-
MD5
065cf92b7519116b3cbb416e7d31dfba
-
SHA1
706b218470e606e34d6605b6ed776f67c35efc94
-
SHA256
091305d3595b7324e7fb674b6120cdb142a6196e796f890fd625e76a014211e8
-
SHA512
588e33825a813d9ed577e76c8926246633886b6f653f5ddc6f515c16fffbf5438018ba71eb720251d3d53bde1a780acdeb3723148ee6b8604cc168375b451f37
-
SSDEEP
6144:/Jepo8KR2VeL6CIVNcCCBxvIM+PBJUWaYh08H+xxPC8ZhG1xVaqklq5LTyrHsVfm:amZQVtY9GA/4QWM723tlC1tRX0po/9D
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-