Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

Shipment document.exe

windows7-x64

6

Shipment document.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Shipment document.zip

  • Size

    599KB

  • Sample

    230802-ja6sxsee6z

  • MD5

    bb62ed76c8d03c0382d0eb0dd062270c

  • SHA1

    a5c7c2e337233b8aee8cfc4ff018566328432124

  • SHA256

    8beb92a6f2e2a9c7245de0d996e68c4de4d6f555cdd85bed4fd8ccc4f158045f

  • SHA512

    cea7f3da1f77585a1a8bce60ae38a9a9d40c99689490ad31eb4e3d37d7c44b6fb237461d268e095f7815846b282966f51f9e41c4486c6680dd86010019b4dbd8

  • SSDEEP

    12288:EmPsuFkE19ZgdnU6ANYZZakyVyx5elyBtjwd1GyN07zjzMxs0oVtIGfjkWigXNH6:LRNZgWpYLaqxoUwdQGKz70itDYWDtMH

Score
6/10
persistence

Malware Config

Targets

    • Target

      Shipment document.exe

    • Size

      664KB

    • MD5

      a8cd4eaa803c78d7d60de36ddea14cca

    • SHA1

      c5a605e276de95ece9098f8effd28d54aaf41edc

    • SHA256

      3a04516d71e6a24f0f20da46230239ca177e6c1d76cb887948344694e2a376a4

    • SHA512

      91a063a80bb01cfdc44edd48c8959eed1439709bac69fbab05b3157e5186062cfd8e15752c29812dc0fb8cf21cb1cd2f216b938ac09e7d4ec4c06a5e33969f47

    • SSDEEP

      12288:3g7JduIEEnU6ANYZZQkyVy55elgBrjwt1GyR07zjzMxsFleptgRCtQoHb9HBENmC:3g7yIEtpYLQq5omwtQoKz7F+iRCmoxwh

    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks