Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ordin de plată.docx

windows7-x64

10

ordin de plată.docx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ordin de plată.docx.doc

  • Size

    263KB

  • Sample

    241009-pc65csthjl

  • MD5

    2d20284313333f0385ad8a987114c363

  • SHA1

    94cfb99f0653f2af35b1e6060ca937c449aba733

  • SHA256

    576967b419975a113a701e12c15d88f112999433d2f2015cdd703b495c9f683a

  • SHA512

    4b8d59a9fbbcd2bc7ab9e62b34fff30ede515c233f1018baeaea93bd4be3d98ee6a3e4eac862ba9d9524e012db328bce14739b1ac4e4c20b85cd089bddffeb8c

  • SSDEEP

    6144:RJwFUSQxWaMdVe0ic9vlN2xfMbbnlR8ybMfAKuBg:fweSsWaMKavbtbno485u6

Score
10/10
discoveryexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg%20
exe.dropper

https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg%20

Targets

    • Target

      ordin de plată.docx.doc

    • Size

      263KB

    • MD5

      2d20284313333f0385ad8a987114c363

    • SHA1

      94cfb99f0653f2af35b1e6060ca937c449aba733

    • SHA256

      576967b419975a113a701e12c15d88f112999433d2f2015cdd703b495c9f683a

    • SHA512

      4b8d59a9fbbcd2bc7ab9e62b34fff30ede515c233f1018baeaea93bd4be3d98ee6a3e4eac862ba9d9524e012db328bce14739b1ac4e4c20b85cd089bddffeb8c

    • SSDEEP

      6144:RJwFUSQxWaMdVe0ic9vlN2xfMbbnlR8ybMfAKuBg:fweSsWaMKavbtbno485u6

    Score
    10/10
    discoveryexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Abuses OpenXML format to download file from external location

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks