Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.0MB

  • Sample

    240921-ra4ybswalg

  • MD5

    9b990bb6a27b497a1a19b8665b02b557

  • SHA1

    6118853f672139bde9972d26a0045389c8ae8733

  • SHA256

    6f2c63f929acd8918c8f21f6141d1b13ca35a2b291d2d8d66771c80f481aea49

  • SHA512

    2015335dd9db06512e57ab44a8b48ef2672e515c6edfb4024431d531d6d64d97e0ab98cf6cf7259512b0497e6acfd3415ed1399f62bcd4145cee607b10e79eaa

  • SSDEEP

    24576:x9gTHCF+YdCBMGq8TBUfnrO/E7Bup/884hvndKzVDDuy3enn:xejafEBUvyj884uzxDqn

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      file.exe

    • Size

      1.0MB

    • MD5

      9b990bb6a27b497a1a19b8665b02b557

    • SHA1

      6118853f672139bde9972d26a0045389c8ae8733

    • SHA256

      6f2c63f929acd8918c8f21f6141d1b13ca35a2b291d2d8d66771c80f481aea49

    • SHA512

      2015335dd9db06512e57ab44a8b48ef2672e515c6edfb4024431d531d6d64d97e0ab98cf6cf7259512b0497e6acfd3415ed1399f62bcd4145cee607b10e79eaa

    • SSDEEP

      24576:x9gTHCF+YdCBMGq8TBUfnrO/E7Bup/884hvndKzVDDuy3enn:xejafEBUvyj884uzxDqn

    Score
    10/10
    discoverypersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks