Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
7Win11DeathEdition.exe
windows11-21h2-x64
8Windows 11...er.exe
windows11-21h2-x64
7Windows 11...lp.chm
windows11-21h2-x64
1Windows 11...on.cmd
windows11-21h2-x64
1Windows 11...gm.exe
windows11-21h2-x64
3Windows 11...pe.vbs
windows11-21h2-x64
3Windows 11...br.exe
windows11-21h2-x64
6Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/09/2024, 01:16
Behavioral task
behavioral1
Sample
Win11DeathEdition.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Windows 11 Death Edition Source Code/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Windows 11 Death Edition Source Code/Bat To Exe Converter/help.chm
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Windows 11 Death Edition Source Code/Win11DeathEdition.cmd
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Windows 11 Death Edition Source Code/bgm.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Windows 11 Death Edition Source Code/escape.vbs
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Windows 11 Death Edition Source Code/mbr.exe
Resource
win11-20240802-en
General
-
Target
Windows 11 Death Edition Source Code/mbr.exe
-
Size
1.3MB
-
MD5
597309673628821262337de44e464773
-
SHA1
76f8af0dfd0e955c3334beddf537ca627e371754
-
SHA256
7947e5a4195b52ce9fe4133f21a7c8bcf9d90495fddbb49939976f7819c93e21
-
SHA512
d739cb91e20860d73e14df2a24364ae61932b81a6a07b86e3fbd35eee9ca12db5ca9ef02e16723896414701f61d8b80563e2f83187515d1fc67bbf0d705a57dc
-
SSDEEP
24576:RT3LlvRiQNGYXCI+b1w30WgvZef6YhuQ5O3h3JMtbu:dXNGDIu8NyMtbu
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 mbr.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe