Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
V_main.exe
-
Size
2.4MB
-
Sample
241013-q41bkavajm
-
MD5
eb20ae7073c363f97b2a42878b6bdbc4
-
SHA1
ff1ad88be18ceb8bc3167d1b18d71b08138b270d
-
SHA256
fb04167bc46b106878144485fb1d7f712d976e8717062dcf581e539036c10922
-
SHA512
ee04988373fab6e26e8ef174bcbea2e3315ccfef5f3e2bfd6c65c8ae01bf10900f18d27b68eab15a63eb2e75c7c51f5df9426bbffb918d9301d08114aee2c423
-
SSDEEP
49152:tWs9ii2J+AQceZktazy0nKxzxpW8gezQJ97BcnTIQ6aDbEPy9T:tWs9ii2J+ZZkozznK70teUBcTgZy9T
Static task
static1
Behavioral task
behavioral1
Sample
V_main.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
V_main.exe
-
Size
2.4MB
-
MD5
eb20ae7073c363f97b2a42878b6bdbc4
-
SHA1
ff1ad88be18ceb8bc3167d1b18d71b08138b270d
-
SHA256
fb04167bc46b106878144485fb1d7f712d976e8717062dcf581e539036c10922
-
SHA512
ee04988373fab6e26e8ef174bcbea2e3315ccfef5f3e2bfd6c65c8ae01bf10900f18d27b68eab15a63eb2e75c7c51f5df9426bbffb918d9301d08114aee2c423
-
SSDEEP
49152:tWs9ii2J+AQceZktazy0nKxzxpW8gezQJ97BcnTIQ6aDbEPy9T:tWs9ii2J+ZZkozznK70teUBcTgZy9T
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-