Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

  • Size

    400KB

  • Sample

    221002-ebf7faffe9

  • MD5

    701866df405b186ee9cd163328f8cd10

  • SHA1

    f5eef955245e0b5a497e09c17eeb160742530875

  • SHA256

    64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

  • SHA512

    a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

  • SSDEEP

    6144:kHbbELf/MR/cWdi5pV/JNWOVhMW668UXreVX7IcJIch:AdOpNX1hp8U78JIch

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

    • Size

      400KB

    • MD5

      701866df405b186ee9cd163328f8cd10

    • SHA1

      f5eef955245e0b5a497e09c17eeb160742530875

    • SHA256

      64f38d7bf45677bc986cb40a2462c9596dd47cd2f78f442552b84f60010c3e79

    • SHA512

      a9175a1e36b7ed92ae6ae62ff9cf55bc77a5a06aae14228370c111a44457d144d76d284115f666ee1f2fed27cc67858fd40ac22dc09922b7f6c57338cd034f17

    • SSDEEP

      6144:kHbbELf/MR/cWdi5pV/JNWOVhMW668UXreVX7IcJIch:AdOpNX1hp8U78JIch

    • Modifies firewall policy service

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v6

Tasks