Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Roshade Setup 3.2.4.exe

  • Size

    5.3MB

  • Sample

    230114-pd1c7sfa73

  • MD5

    52d036cbb422481d856a9f10f3fed6c8

  • SHA1

    40bb744fcbe8362624cd7feb7b18095de97f8211

  • SHA256

    e49e8e38396e4b4ddff80e8ddf708e2070d793ece7beb4f2200a5360312a1c0d

  • SHA512

    f59b637ac5b7b885c3d81211999d0c9f0329923ad25ce39cded285b3383cb25e051d0e429638b1c3a10e6219ad821148b980d98b8e50b372ad52e9656a8ed723

  • SSDEEP

    98304:FEZsqCJ8v/8/ENU1jKporlfJ1JwEDlPz+sqHo0HipM3P5Fqbb6qojZuffbgYm:FETCCvkse1z3nwElCprifbRm

Malware Config

Targets

    • Target

      Roshade Setup 3.2.4.exe

    • Size

      5.3MB

    • MD5

      52d036cbb422481d856a9f10f3fed6c8

    • SHA1

      40bb744fcbe8362624cd7feb7b18095de97f8211

    • SHA256

      e49e8e38396e4b4ddff80e8ddf708e2070d793ece7beb4f2200a5360312a1c0d

    • SHA512

      f59b637ac5b7b885c3d81211999d0c9f0329923ad25ce39cded285b3383cb25e051d0e429638b1c3a10e6219ad821148b980d98b8e50b372ad52e9656a8ed723

    • SSDEEP

      98304:FEZsqCJ8v/8/ENU1jKporlfJ1JwEDlPz+sqHo0HipM3P5Fqbb6qojZuffbgYm:FETCCvkse1z3nwElCprifbRm

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Registers COM server for autorun

    • Sets file execution options in registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks