Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

blood Gas ...er.vbs

windows7-x64

10

blood Gas ...er.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    blood Gas analyzer tender.vbs

  • Size

    19KB

  • Sample

    240604-gtq6gaff2t

  • MD5

    ff267c328cb452fecf9126af29565e92

  • SHA1

    2b64e8e45343ee2adb2cb9f51039da909fa912de

  • SHA256

    db9151a29924eaa6b7fd1f9395d256285deb924445e26cf383ed84722debedef

  • SHA512

    9164f8b9147ec53975cf7a8d694cf04cf82ac430d3c23efc48bc574d3590e1908649c5b17b508fa94ceed08ef7d89310a68b366624a3c7c5c5332b5a7afd33ea

  • SSDEEP

    192:yMgigjO6uXXVex0J/8NrVmb1SWyDG7+8gHkvOUfvnFn61qtHoLg3TaPK:yMgiquXXsxWOr4GDw+PHKOyJrDwK

Score
10/10
guloaderdownloader

Malware Config

Targets

    • Target

      blood Gas analyzer tender.vbs

    • Size

      19KB

    • MD5

      ff267c328cb452fecf9126af29565e92

    • SHA1

      2b64e8e45343ee2adb2cb9f51039da909fa912de

    • SHA256

      db9151a29924eaa6b7fd1f9395d256285deb924445e26cf383ed84722debedef

    • SHA512

      9164f8b9147ec53975cf7a8d694cf04cf82ac430d3c23efc48bc574d3590e1908649c5b17b508fa94ceed08ef7d89310a68b366624a3c7c5c5332b5a7afd33ea

    • SSDEEP

      192:yMgigjO6uXXVex0J/8NrVmb1SWyDG7+8gHkvOUfvnFn61qtHoLg3TaPK:yMgiquXXsxWOr4GDw+PHKOyJrDwK

    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks