Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
284b37c4771f4dcf91a37348014e04ff
-
Size
928KB
-
Sample
231221-3mq3sadeh8
-
MD5
284b37c4771f4dcf91a37348014e04ff
-
SHA1
211e5aa4cc0451aa252660576fc5c6a1961667fd
-
SHA256
749b990f8fe76d019574a8084e4bc6dccaef3c4370f14d1ff3097d82b6176913
-
SHA512
dddfd3b527d57ef5b2ac806ca7c083033d05b0df39b7b6513069c91eb43c8645ee2641e5203366a53de3abd7578f254d84ea2ebaebf33388d591d2db787fa568
-
SSDEEP
24576:+TSkT7/hjVX1uKLGLY27AX1Wh6qC/UxPpXWhi:Evl3LG0h1KZkwPhW
Static task
static1
Behavioral task
behavioral1
Sample
284b37c4771f4dcf91a37348014e04ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
284b37c4771f4dcf91a37348014e04ff.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\ProgramData\pkbwrrm.html
http://jssestaew3e7ao3q.onion.cab
http://jssestaew3e7ao3q.tor2web.org
http://jssestaew3e7ao3q.onion
Targets
-
-
Target
284b37c4771f4dcf91a37348014e04ff
-
Size
928KB
-
MD5
284b37c4771f4dcf91a37348014e04ff
-
SHA1
211e5aa4cc0451aa252660576fc5c6a1961667fd
-
SHA256
749b990f8fe76d019574a8084e4bc6dccaef3c4370f14d1ff3097d82b6176913
-
SHA512
dddfd3b527d57ef5b2ac806ca7c083033d05b0df39b7b6513069c91eb43c8645ee2641e5203366a53de3abd7578f254d84ea2ebaebf33388d591d2db787fa568
-
SSDEEP
24576:+TSkT7/hjVX1uKLGLY27AX1Wh6qC/UxPpXWhi:Evl3LG0h1KZkwPhW
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-