Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ad74981909d69f775885e19a1040435e3b8afe73b4a1e5d35861d502bfed8da4.exe
-
Size
1.9MB
-
Sample
241003-cc6sdasdle
-
MD5
0feb901e23751d111fc025ab2be3c2f5
-
SHA1
38f8d59ab5dfb96e4070bd9ec269d2904c6a3a76
-
SHA256
ad74981909d69f775885e19a1040435e3b8afe73b4a1e5d35861d502bfed8da4
-
SHA512
34fc5fdf243d0fff3287110bc8d109db83ccb88e7189e87ee8d27784826cf5267b22b45fec035f25677e75b41d7993a6e5b2884cff0e0abf8073150c20e081ec
-
SSDEEP
24576:2TbBv5rUyXVPr3aJEs7H+rhar+lA7ukc7t6vysCpz4FcJFrkQwuQjkmJQep9si:IBJPcziJG7WBnpz4FcJFAQ7Qjkmpt
Static task
static1
Behavioral task
behavioral1
Sample
ad74981909d69f775885e19a1040435e3b8afe73b4a1e5d35861d502bfed8da4.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
ad74981909d69f775885e19a1040435e3b8afe73b4a1e5d35861d502bfed8da4.exe
-
Size
1.9MB
-
MD5
0feb901e23751d111fc025ab2be3c2f5
-
SHA1
38f8d59ab5dfb96e4070bd9ec269d2904c6a3a76
-
SHA256
ad74981909d69f775885e19a1040435e3b8afe73b4a1e5d35861d502bfed8da4
-
SHA512
34fc5fdf243d0fff3287110bc8d109db83ccb88e7189e87ee8d27784826cf5267b22b45fec035f25677e75b41d7993a6e5b2884cff0e0abf8073150c20e081ec
-
SSDEEP
24576:2TbBv5rUyXVPr3aJEs7H+rhar+lA7ukc7t6vysCpz4FcJFrkQwuQjkmJQep9si:IBJPcziJG7WBnpz4FcJFAQ7Qjkmpt
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1