Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6744b518ec9ccb2012bdbf736c7e187a
-
Size
13.2MB
-
Sample
240119-leabmabgb5
-
MD5
6744b518ec9ccb2012bdbf736c7e187a
-
SHA1
2d1197901aca6e7e331319a57ac3eeaf15245731
-
SHA256
74868d600acb1c900eb7643f849d64b4e029a0417d091b1833672bbc0eaf49a1
-
SHA512
d3b84833a751b58d70d3e590df0982c5965d8cfa81bfcce9eeca47dff42355201dc30d396a7ea69ec49823ee874c29ed4bf97a069aeabfe393e45bebc2cd2f77
-
SSDEEP
49152:NgMtttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt1:N
Static task
static1
Behavioral task
behavioral1
Sample
6744b518ec9ccb2012bdbf736c7e187a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6744b518ec9ccb2012bdbf736c7e187a.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
6744b518ec9ccb2012bdbf736c7e187a
-
Size
13.2MB
-
MD5
6744b518ec9ccb2012bdbf736c7e187a
-
SHA1
2d1197901aca6e7e331319a57ac3eeaf15245731
-
SHA256
74868d600acb1c900eb7643f849d64b4e029a0417d091b1833672bbc0eaf49a1
-
SHA512
d3b84833a751b58d70d3e590df0982c5965d8cfa81bfcce9eeca47dff42355201dc30d396a7ea69ec49823ee874c29ed4bf97a069aeabfe393e45bebc2cd2f77
-
SSDEEP
49152:NgMtttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt1:N
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2