Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
idman642build3.exe
-
Size
11.5MB
-
Sample
240304-p8mqlaca29
-
MD5
84582a8bb1288350b17d9fec4323a8a4
-
SHA1
2703a051f265c72a46099021e7873bfcbe073787
-
SHA256
26e1d8e4838ee3334b1d9c2622ed6197c93e87487bc0fefcf29216cee72858f5
-
SHA512
4bf7c1fefb62c055d703505b742484bb3250d98bb95f01690090414966a2711ba2991b312944b32c058b6ca4ee7cfebb9f323b274b4326a178502d032ecd1739
-
SSDEEP
196608:jlX5piz5kAUfv6Tbj/66PWBNDyhZNUZMnarsrfoNpA/ZA2Bswc9D2pejlN9rpf:Hk5Pb/nWWirs0pYZhc9Kp6N9rpf
Static task
static1
Behavioral task
behavioral1
Sample
idman642build3.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
idman642build3.exe
-
Size
11.5MB
-
MD5
84582a8bb1288350b17d9fec4323a8a4
-
SHA1
2703a051f265c72a46099021e7873bfcbe073787
-
SHA256
26e1d8e4838ee3334b1d9c2622ed6197c93e87487bc0fefcf29216cee72858f5
-
SHA512
4bf7c1fefb62c055d703505b742484bb3250d98bb95f01690090414966a2711ba2991b312944b32c058b6ca4ee7cfebb9f323b274b4326a178502d032ecd1739
-
SSDEEP
196608:jlX5piz5kAUfv6Tbj/66PWBNDyhZNUZMnarsrfoNpA/ZA2Bswc9D2pejlN9rpf:Hk5Pb/nWWirs0pYZhc9Kp6N9rpf
Score8/10-
Drops file in Drivers directory
-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2