Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

88_SETUP.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88_SETUP.exe

  • Size

    84KB

  • Sample

    240427-n4p5gsaa63

  • MD5

    78d7c0fd7f3c2899389b7c6eb070633e

  • SHA1

    d295cc9c0e6996eb3b3c718832b76bed7a0ac830

  • SHA256

    bb25d336575bf1ddea1c4d4dfd46c0d5763e864616b3382b2fe858722dc20376

  • SHA512

    a4d1f3eb023c32a6afd19a6ee536ce088d428cfd37b6d3de20a8a7c2910bd24850efd83e0e36d7663dff0d4fe5109c02cda7eb182ba603b8b2eaff460d4e4975

  • SSDEEP

    1536:3igyMZ/lsDX1fUTKyrTu3XPjNwKnSrRrMye+yi8h0G8fLQe49VDj:w13yO3XP1SGye+yiXGULQJ9VDj

Score
10/10
evasionransomware

Malware Config

Targets

    • Target

      88_SETUP.exe

    • Size

      84KB

    • MD5

      78d7c0fd7f3c2899389b7c6eb070633e

    • SHA1

      d295cc9c0e6996eb3b3c718832b76bed7a0ac830

    • SHA256

      bb25d336575bf1ddea1c4d4dfd46c0d5763e864616b3382b2fe858722dc20376

    • SHA512

      a4d1f3eb023c32a6afd19a6ee536ce088d428cfd37b6d3de20a8a7c2910bd24850efd83e0e36d7663dff0d4fe5109c02cda7eb182ba603b8b2eaff460d4e4975

    • SSDEEP

      1536:3igyMZ/lsDX1fUTKyrTu3XPjNwKnSrRrMye+yi8h0G8fLQe49VDj:w13yO3XP1SGye+yiXGULQJ9VDj

    Score
    10/10
    evasionransomware

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks