Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

s.bat

windows7-x64

8

s.bat

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    s.bat

  • Size

    864KB

  • Sample

    240515-2txngage64

  • MD5

    42c72c26bb7fc92064808e8edb9efdbc

  • SHA1

    8b9cb6f781b99cc723aa2a0d9bcffecd73a5490a

  • SHA256

    722c42c544ec40709b016906077aa4ee555c414a998e3986d9b44e4cfb28b4c2

  • SHA512

    7ac1c09e3242eb3d43d9a1c86e1abd5c1cdc75b5a32881a7287defb0407010533c891eaa0b0d12a496d885ebfc3bc41b57934dfe55a979f0a08a2745d61c167e

  • SSDEEP

    24576:ifUMJg2oIqiT97xw/+JOg0MJcz/aaCbZr:SU/s1T9N0/aawr

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      s.bat

    • Size

      864KB

    • MD5

      42c72c26bb7fc92064808e8edb9efdbc

    • SHA1

      8b9cb6f781b99cc723aa2a0d9bcffecd73a5490a

    • SHA256

      722c42c544ec40709b016906077aa4ee555c414a998e3986d9b44e4cfb28b4c2

    • SHA512

      7ac1c09e3242eb3d43d9a1c86e1abd5c1cdc75b5a32881a7287defb0407010533c891eaa0b0d12a496d885ebfc3bc41b57934dfe55a979f0a08a2745d61c167e

    • SSDEEP

      24576:ifUMJg2oIqiT97xw/+JOg0MJcz/aaCbZr:SU/s1T9N0/aawr

    Score
    8/10
    executionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks