Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8
-
Size
344KB
-
Sample
231114-xjjlmsed9w
-
MD5
73b6567e0fb62eeb98aeaa8af712c650
-
SHA1
a540265e45623ef70377b6d21118b732835a8337
-
SHA256
38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8
-
SHA512
2e03cdb91083ad989caa260fde1646f011a3632067495ff18367056c7873a804fc9898b8462fd8736ac0d351472d61fb789cf3383b16f28d1cef5551e1041c71
-
SSDEEP
6144:h04sqI3VM+bMHClEf6HCAW3/hpb7BuHRaumHyxaK3yaFPR65n:C4sx3VNbMilED5v3CRPsykK3DF
Static task
static1
Behavioral task
behavioral1
Sample
38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\{RecOveR}-eiyjm__.Txt
http://h3ds4.maconslab.com/ADD242BA48CC76C
http://aq3ef.goimocoa.at/ADD242BA48CC76C
http://fl43s.toabolt.at/ADD242BA48CC76C
http://xzjvzkgjxebzreap.onion/ADD242BA48CC76C
Extracted
C:\PerfLogs\{RecOveR}-guexu__.Txt
http://h3ds4.maconslab.com/E8F7436B6D893B0
http://aq3ef.goimocoa.at/E8F7436B6D893B0
http://fl43s.toabolt.at/E8F7436B6D893B0
http://xzjvzkgjxebzreap.onion/E8F7436B6D893B0
Targets
-
-
Target
38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8
-
Size
344KB
-
MD5
73b6567e0fb62eeb98aeaa8af712c650
-
SHA1
a540265e45623ef70377b6d21118b732835a8337
-
SHA256
38b3ad07b35d7dcbd054e87295ee1d60ab2f894111d458e88c6c183cd7ffefc8
-
SHA512
2e03cdb91083ad989caa260fde1646f011a3632067495ff18367056c7873a804fc9898b8462fd8736ac0d351472d61fb789cf3383b16f28d1cef5551e1041c71
-
SSDEEP
6144:h04sqI3VM+bMHClEf6HCAW3/hpb7BuHRaumHyxaK3yaFPR65n:C4sx3VNbMilED5v3CRPsykK3DF
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-