Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
PO_La-Tanerie04180240124.vbs
-
Size
187KB
-
Sample
240418-xprt7sdc4y
-
MD5
2ea61e83ee687b29c058279893e1df8c
-
SHA1
0c6fc46e4a0bf4c62a5cd2e263313e82f2977a50
-
SHA256
a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc
-
SHA512
a810bd13d522775d4d9c3ef3e6775da5cc34db90d4826da9c96fb37c1d84dd37ad5eb84fc2c3095b3a9a065fbbd54a4892f96d867f879de14708d4f409f82ca8
-
SSDEEP
3072:2vU8jq6KK8ccABOwbDS2y2zJETxUuoHh38zH/O4SCvewvB7wrsCREBJo5mFSar+c:J6R8ccABOwbDA2zJETxVu1iH/GsW3EBB
Static task
static1
Behavioral task
behavioral1
Sample
PO_La-Tanerie04180240124.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PO_La-Tanerie04180240124.vbs
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
PO_La-Tanerie04180240124.vbs
-
Size
187KB
-
MD5
2ea61e83ee687b29c058279893e1df8c
-
SHA1
0c6fc46e4a0bf4c62a5cd2e263313e82f2977a50
-
SHA256
a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc
-
SHA512
a810bd13d522775d4d9c3ef3e6775da5cc34db90d4826da9c96fb37c1d84dd37ad5eb84fc2c3095b3a9a065fbbd54a4892f96d867f879de14708d4f409f82ca8
-
SSDEEP
3072:2vU8jq6KK8ccABOwbDS2y2zJETxUuoHh38zH/O4SCvewvB7wrsCREBJo5mFSar+c:J6R8ccABOwbDA2zJETxVu1iH/GsW3EBB
Score8/10-
Adds policy Run key to start application
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-