Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    FakeActivation.zip

  • Size

    275KB

  • Sample

    240914-tcknkssamk

  • MD5

    6db8a7da4e8dc527d445b7a37d02d5d6

  • SHA1

    4fcc7cff8b49a834858d8c6016c3c6f109c9c794

  • SHA256

    7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

  • SHA512

    b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

  • SSDEEP

    6144:slA1Q2B6SIHODfBeO6706bWyFyA3tvZqfgP6mJJtkvnBM1KgHWR:iCQ2B3IHO1e3WeGoHJJtkvnBOi

Malware Config

Targets

    • Target

      FakeActivation.zip

    • Size

      275KB

    • MD5

      6db8a7da4e8dc527d445b7a37d02d5d6

    • SHA1

      4fcc7cff8b49a834858d8c6016c3c6f109c9c794

    • SHA256

      7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

    • SHA512

      b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

    • SSDEEP

      6144:slA1Q2B6SIHODfBeO6706bWyFyA3tvZqfgP6mJJtkvnBM1KgHWR:iCQ2B3IHO1e3WeGoHJJtkvnBOi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks