Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/08/2023, 02:27

230831-cxlypscd38 8

05/06/2023, 10:42

230605-mrst6sga44 10

05/06/2023, 10:36

230605-mnqweaga25 10

General

  • Target

    Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe

  • Size

    10.8MB

  • Sample

    230605-mnqweaga25

  • MD5

    fc30f38c629fbafcfd1f4a4895814c46

  • SHA1

    e6b298591f7034463f603ede1573c8a198938b7f

  • SHA256

    40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9

  • SHA512

    74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2

  • SSDEEP

    196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x

Malware Config

Targets

    • Target

      Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe

    • Size

      10.8MB

    • MD5

      fc30f38c629fbafcfd1f4a4895814c46

    • SHA1

      e6b298591f7034463f603ede1573c8a198938b7f

    • SHA256

      40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9

    • SHA512

      74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2

    • SSDEEP

      196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks