Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1d7eaebfd2a61cec5b8701148f4226b3
-
Size
13.6MB
-
Sample
231230-1my3aaeggm
-
MD5
1d7eaebfd2a61cec5b8701148f4226b3
-
SHA1
d6a2723b8007f0bd295d2243c9ecaa6e73decadc
-
SHA256
05a8af759237e4c4b84f685669ac722006c97938991fadd34ec9bbd0ef2d58e2
-
SHA512
6d0b45dce771065609467f89d294f4500314c1fbf37c21a214f415ad8aa79b7773bdaf1119e8f5130e385906c2094c1e697661e336567424776fa6863a727f9b
-
SSDEEP
49152:6j5555555555555555555555555555555555555555555555555555555555555t:
Static task
static1
Behavioral task
behavioral1
Sample
1d7eaebfd2a61cec5b8701148f4226b3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d7eaebfd2a61cec5b8701148f4226b3.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
1d7eaebfd2a61cec5b8701148f4226b3
-
Size
13.6MB
-
MD5
1d7eaebfd2a61cec5b8701148f4226b3
-
SHA1
d6a2723b8007f0bd295d2243c9ecaa6e73decadc
-
SHA256
05a8af759237e4c4b84f685669ac722006c97938991fadd34ec9bbd0ef2d58e2
-
SHA512
6d0b45dce771065609467f89d294f4500314c1fbf37c21a214f415ad8aa79b7773bdaf1119e8f5130e385906c2094c1e697661e336567424776fa6863a727f9b
-
SSDEEP
49152:6j5555555555555555555555555555555555555555555555555555555555555t:
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2