Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b130b38339a2f2a0c5e0882de2a32f78501a356dc839028ce214474b1615854e

  • Size

    205KB

  • Sample

    221202-2llagaef9v

  • MD5

    ccc82b1ee2cb94ef4772c9bae5e5a11b

  • SHA1

    37dceddb90196ca9b4b8320aa8f20eb398bf0c2f

  • SHA256

    b130b38339a2f2a0c5e0882de2a32f78501a356dc839028ce214474b1615854e

  • SHA512

    cf16c1208b41f858d69764076d7c5e5dc78e8875d7737adde936e7b1c348dced744b9d6ca9604289310eebed0cbeded9c13033680bef9ae61edde3d854bcfe84

  • SSDEEP

    3072:VqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:VqhMPssRARoiSoS3SsQLH5AK

Malware Config

Targets

    • Target

      b130b38339a2f2a0c5e0882de2a32f78501a356dc839028ce214474b1615854e

    • Size

      205KB

    • MD5

      ccc82b1ee2cb94ef4772c9bae5e5a11b

    • SHA1

      37dceddb90196ca9b4b8320aa8f20eb398bf0c2f

    • SHA256

      b130b38339a2f2a0c5e0882de2a32f78501a356dc839028ce214474b1615854e

    • SHA512

      cf16c1208b41f858d69764076d7c5e5dc78e8875d7737adde936e7b1c348dced744b9d6ca9604289310eebed0cbeded9c13033680bef9ae61edde3d854bcfe84

    • SSDEEP

      3072:VqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:VqhMPssRARoiSoS3SsQLH5AK

    • Modifies WinLogon for persistence

    • Modifies system executable filetype association

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • UAC bypass

    • Disables RegEdit via registry modification

    • Disables use of System Restore points

    • Executes dropped EXE

    • Sets file execution options in registry

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks