Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
26/04/2024, 06:47
240426-hkqc9aba9v 626/04/2024, 06:47
240426-hkprqabb44 626/04/2024, 06:47
240426-hkn57abb42 626/04/2024, 06:47
240426-hkmx5aba9t 626/04/2024, 06:47
240426-hkmmcsba81 625/04/2024, 13:14
240425-qgyt8aba6y 7Analysis
-
max time kernel
273s -
max time network
274s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
Resource
win11-20240412-en
General
-
Target
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
-
Size
131KB
-
MD5
fa158ba3d7801e203da61c7eafa12a13
-
SHA1
eb71f862c7603797a9d7d46bda545f7d9280f451
-
SHA256
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521
-
SHA512
0f47c06526cb8d0e8302e440baac91e49e1fa3541e8d86e724c46dcc3b4ba2ffae445b3d217d58cb8ff66380036b98e82fc7b6f3980120d4c599d5497ce5edd1
-
SSDEEP
1536:BL+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/xf6KWcs8+SUkIcekqY1o/uImz2:BLxUyjp3xCTyDMsUWyw+Ubx7NX
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 87.236.195.203 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\unz2u6rwlq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe" ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.