Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
d6f2939e76d1c492c3d6c28b3b6b89a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d6f2939e76d1c492c3d6c28b3b6b89a0.exe
Resource
win10v2004-20240226-en
General
-
Target
d6f2939e76d1c492c3d6c28b3b6b89a0.exe
-
Size
49KB
-
MD5
d6f2939e76d1c492c3d6c28b3b6b89a0
-
SHA1
6f97364ae27d92525b2f5c0666c469fe15a879f7
-
SHA256
606f0b533e4849eaa7bfc7be3d19f6175bf2ba911f7eb110352a81240fe3d924
-
SHA512
f8bcd42d1c7f68a149423f9e22c03df8e532a7ad2dd209cf0fbe0661bae13d75b3fd9a40e90d98d7eccd5983c77eda4b1446235dbc2e3169aaa99222b6d62ed4
-
SSDEEP
768:8XbRPYW5tbi1G1x4nIHELNh8CUhQiDUtrEg5qkcrJ:8VPYW5tecx4nIkL7StDUtYj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\International\Geo\Nation d6f2939e76d1c492c3d6c28b3b6b89a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2972 d6f2939e76d1c492c3d6c28b3b6b89a0.exe