Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.zip
-
Size
143KB
-
Sample
230311-q2m88abf5x
-
MD5
86737721f1af3bef22c4cac9c6de1a6a
-
SHA1
ac4761d89c27069133d0973ad6c0482ecbbd4470
-
SHA256
7da10be7c1f7da766219ac0bb0cd772e65b8d0881561ae02c42d5dd1a94f982d
-
SHA512
dc0e8c0ce5b76650cf3fd89aab038d970809d46c5d70f05b266e04093d4bb928ece0db0df153d1fc9f228ffade11914b9f0a1843c434cba3015b283da56e3476
-
SSDEEP
3072:C5BScNHH46PPoTeHLkk9s5j+WOWqgbnhKRypw6NauwANECRtQ5B2O4jqQwUeGVJU:uBtHH4Wbu5SIbI/6fzOCRtQ5B2Ok3eZ
Static task
static1
Behavioral task
behavioral1
Sample
f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.exe
-
Size
149KB
-
MD5
7d8f0e539e50eb545d094c50aab0ea9e
-
SHA1
9368da690ace5328abc4461cd8322d78c1fdc290
-
SHA256
f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9
-
SHA512
092d05eb357da75c2a6646a353e1c1cf7f0ae66ea32ac4beff8fda87160c9226417b187b4ac34e7b5745aaa65c8a6b8b33b9f02e19d9a959627544b50a3eae7a
-
SSDEEP
3072:Pmpq7ybSPGccu5R9Wl7rSmpVYc7+DUltw/ArIW1:epqG2eM5R9kNj2UlgJ
Score10/10-
Modifies WinLogon for persistence
-
mimikatz is an open source tool to dump credentials on Windows
-
Contacts a large (837) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Winlogon Helper DLL
1