Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ae6930169cd4de5d17e2321e5335fe9b42a330350f4df96b270fa42fba308921

  • Size

    201KB

  • Sample

    221011-q64rrsggdp

  • MD5

    1023918366579db644dc268ccee04400

  • SHA1

    8d20772b702ec14f3f2733c342d43e9fcfdf645a

  • SHA256

    ae6930169cd4de5d17e2321e5335fe9b42a330350f4df96b270fa42fba308921

  • SHA512

    6c589a9bd02b0f99f6f6d1a302808d9a0a45de3f631c7935b144be9fdd9af1ea4f4b81be26d6807a6bfbaf411537b74409940169a940d17aae1d1ffbf9e785e2

  • SSDEEP

    3072:xJk9XB/2Q/0M5kJJixTi2lmNEedkoEvKVfaGw3Rk2XCdrW:VM5SMdMfkhmGW2X9

Malware Config

Targets

    • Target

      ae6930169cd4de5d17e2321e5335fe9b42a330350f4df96b270fa42fba308921

    • Size

      201KB

    • MD5

      1023918366579db644dc268ccee04400

    • SHA1

      8d20772b702ec14f3f2733c342d43e9fcfdf645a

    • SHA256

      ae6930169cd4de5d17e2321e5335fe9b42a330350f4df96b270fa42fba308921

    • SHA512

      6c589a9bd02b0f99f6f6d1a302808d9a0a45de3f631c7935b144be9fdd9af1ea4f4b81be26d6807a6bfbaf411537b74409940169a940d17aae1d1ffbf9e785e2

    • SSDEEP

      3072:xJk9XB/2Q/0M5kJJixTi2lmNEedkoEvKVfaGw3Rk2XCdrW:VM5SMdMfkhmGW2X9

    • Modifies visiblity of hidden/system files in Explorer

    • UAC bypass

    • Windows security bypass

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks