Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a58814b3eedd304e4dee9c2ce80dfd80895ba6711e1d0478dd276f4e62f77b6f

  • Size

    223KB

  • Sample

    231126-3154vsdb47

  • MD5

    8d3f2f53848fd102286d88695f8a223a

  • SHA1

    6c1990c0d2a15bdd6d259122f4341f5f9c23281b

  • SHA256

    a58814b3eedd304e4dee9c2ce80dfd80895ba6711e1d0478dd276f4e62f77b6f

  • SHA512

    f5ce8c099b0e50ed1cf217281ab7d0e3900415ad43fb4d9dac8a06aad9700585394f0d29d4c4c747e398f00d7de50e79b2730560bdd9015c792f7e3e6cefd80e

  • SSDEEP

    3072:QZ7wXfSRZ0ON/EwW66wN94xu4CkAZJM2k5D66L+NfGbVON2Nqi/6gS5UoWXHz72n:YwPSUONLNsuWA7koN+boRi9S6oiz72D

Score
10/10

Malware Config

Targets

    • Target

      a58814b3eedd304e4dee9c2ce80dfd80895ba6711e1d0478dd276f4e62f77b6f

    • Size

      223KB

    • MD5

      8d3f2f53848fd102286d88695f8a223a

    • SHA1

      6c1990c0d2a15bdd6d259122f4341f5f9c23281b

    • SHA256

      a58814b3eedd304e4dee9c2ce80dfd80895ba6711e1d0478dd276f4e62f77b6f

    • SHA512

      f5ce8c099b0e50ed1cf217281ab7d0e3900415ad43fb4d9dac8a06aad9700585394f0d29d4c4c747e398f00d7de50e79b2730560bdd9015c792f7e3e6cefd80e

    • SSDEEP

      3072:QZ7wXfSRZ0ON/EwW66wN94xu4CkAZJM2k5D66L+NfGbVON2Nqi/6gS5UoWXHz72n:YwPSUONLNsuWA7koN+boRi9S6oiz72D

    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks