Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

PPClientInstaller.msi

windows7-x64

6

PPClientInstaller.msi

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PPClientInstaller.msi

  • Size

    5.5MB

  • Sample

    240423-pc9v9agb25

  • MD5

    00980613a95af934dfff12eea77d3bd4

  • SHA1

    8d9869186bf6236dcfc75891879d4afe817534c6

  • SHA256

    60a85ea9008ff6df7260d2a4e325fee8658ed8df5b90b80ae85a4f8c8ce8f9a3

  • SHA512

    ea7801151c02bb67ab32f3aefb7daec4cc9ea10a18df410919059efbaa4c2c5faeb2bcd00d1ba5b830fe480e9f87697e48c40aebee7810e2d584a2729c8bb67e

  • SSDEEP

    98304:OGII8+2hdfoVEZfPqMg0sloe7Rx3LqxHksWFTfSGa3k/1T+P2wG5Nlzp:/12hZ6EN+O+R1qHks8TfS30tT+UN5

Score
7/10
discoverypersistence

Malware Config

Targets

    • Target

      PPClientInstaller.msi

    • Size

      5.5MB

    • MD5

      00980613a95af934dfff12eea77d3bd4

    • SHA1

      8d9869186bf6236dcfc75891879d4afe817534c6

    • SHA256

      60a85ea9008ff6df7260d2a4e325fee8658ed8df5b90b80ae85a4f8c8ce8f9a3

    • SHA512

      ea7801151c02bb67ab32f3aefb7daec4cc9ea10a18df410919059efbaa4c2c5faeb2bcd00d1ba5b830fe480e9f87697e48c40aebee7810e2d584a2729c8bb67e

    • SSDEEP

      98304:OGII8+2hdfoVEZfPqMg0sloe7Rx3LqxHksWFTfSGa3k/1T+P2wG5Nlzp:/12hZ6EN+O+R1qHks8TfS30tT+UN5

    Score
    7/10
    discoverypersistence

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks