Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    jalinga_studio.4.0.2040.0.exe

  • Size

    170.1MB

  • Sample

    230306-sf7rvach84

  • MD5

    948d7987d54a4726f3478445f6f90b35

  • SHA1

    063678240fd304421339faa6198f2b9c9b29694a

  • SHA256

    eeb186dec0228846271ca3fc21633cf84e0786310a694d31229223399f89bb05

  • SHA512

    5e30ee2e321d66354e745456a070e3a981d2932c10d6eb7c4c0865600a4b8a33e5eb30570793069231a46012221069af79058c9cdc29aa61c8182ad9764a69ed

  • SSDEEP

    3145728:lKINS65gwGtO22RM7Yz+invDgfZsY+RdjKJSPCQuKErDOZX9R9lw/vDLgqLFK82/:o/65gwGf26Yz+irgf6TjKJSPCQxkyZ9r

Malware Config

Targets

    • Target

      jalinga_studio.4.0.2040.0.exe

    • Size

      170.1MB

    • MD5

      948d7987d54a4726f3478445f6f90b35

    • SHA1

      063678240fd304421339faa6198f2b9c9b29694a

    • SHA256

      eeb186dec0228846271ca3fc21633cf84e0786310a694d31229223399f89bb05

    • SHA512

      5e30ee2e321d66354e745456a070e3a981d2932c10d6eb7c4c0865600a4b8a33e5eb30570793069231a46012221069af79058c9cdc29aa61c8182ad9764a69ed

    • SSDEEP

      3145728:lKINS65gwGtO22RM7Yz+invDgfZsY+RdjKJSPCQuKErDOZX9R9lw/vDLgqLFK82/:o/65gwGf26Yz+irgf6TjKJSPCQxkyZ9r

    • Blocklisted process makes network request

    • Modifies Windows Firewall

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks