Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    aadb797f5510dd51561246d61a1e5e1a6157590a248c7f4a8aac374ab0ac2d00

  • Size

    2.0MB

  • Sample

    231116-n73vrabf79

  • MD5

    2f3353e9de4535e858254b2f9ebe0e70

  • SHA1

    beb0fe2c7a977abf0f292477466be291fca80a9a

  • SHA256

    aadb797f5510dd51561246d61a1e5e1a6157590a248c7f4a8aac374ab0ac2d00

  • SHA512

    909bb4cd1108fefed5bdf68af29eb0fbc5584f6c9ce7b7a15790af2c24ac2898ab132e7e95b7ba636c131c645e8aee95ef749dc24f7f05c2eb3808ab6c2146d7

  • SSDEEP

    49152:8Us4vWvQznXPwh11sXIAyT9tN93ul/lDxqqqoqqqdT:ls4iKXPs1sByTNT

Score
10/10

Malware Config

Targets

    • Target

      aadb797f5510dd51561246d61a1e5e1a6157590a248c7f4a8aac374ab0ac2d00

    • Size

      2.0MB

    • MD5

      2f3353e9de4535e858254b2f9ebe0e70

    • SHA1

      beb0fe2c7a977abf0f292477466be291fca80a9a

    • SHA256

      aadb797f5510dd51561246d61a1e5e1a6157590a248c7f4a8aac374ab0ac2d00

    • SHA512

      909bb4cd1108fefed5bdf68af29eb0fbc5584f6c9ce7b7a15790af2c24ac2898ab132e7e95b7ba636c131c645e8aee95ef749dc24f7f05c2eb3808ab6c2146d7

    • SSDEEP

      49152:8Us4vWvQznXPwh11sXIAyT9tN93ul/lDxqqqoqqqdT:ls4iKXPs1sByTNT

    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks