Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

RDPW_installer.exe

windows7-x64

8

RDPW_installer.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RDPW_installer.exe

  • Size

    2.4MB

  • Sample

    230719-pbfk1sec63

  • MD5

    d1e65ecb22859949e55dd791fba5e62f

  • SHA1

    43be70e679bbd34fe82746d6d39fe2511d0c9987

  • SHA256

    923ff70bd31fd27df3c2d91ec555fcf43e93825f695824fdbeb10e4913396e67

  • SHA512

    36e3c3aa1cd103fe9685fa452d0d496e7abf0c2216cd1924d97eee65c1cd724948889b96c9f6c96461cc5ab4db406421a8d0f46316142419448afd096a4a8274

  • SSDEEP

    49152:rQTtgkYU6W9Y3jyI/NLYXDlixRHY+QHl+ItOWpHFB8oQv3YBEpyS5jUR8:rJkfRgjySL2D0xqQyxQvfpykc8

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      RDPW_installer.exe

    • Size

      2.4MB

    • MD5

      d1e65ecb22859949e55dd791fba5e62f

    • SHA1

      43be70e679bbd34fe82746d6d39fe2511d0c9987

    • SHA256

      923ff70bd31fd27df3c2d91ec555fcf43e93825f695824fdbeb10e4913396e67

    • SHA512

      36e3c3aa1cd103fe9685fa452d0d496e7abf0c2216cd1924d97eee65c1cd724948889b96c9f6c96461cc5ab4db406421a8d0f46316142419448afd096a4a8274

    • SSDEEP

      49152:rQTtgkYU6W9Y3jyI/NLYXDlixRHY+QHl+ItOWpHFB8oQv3YBEpyS5jUR8:rJkfRgjySL2D0xqQyxQvfpykc8

    Score
    8/10
    evasionpersistence

    • Modifies RDP port number used by Windows

    • Modifies Windows Firewall

      evasion

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks