Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    88235a4995a5cb37ecec39cafdfa1498c69b43f8f9d2d7bf2e683afbe1e6002c

  • Size

    536KB

  • Sample

    230828-edjqcahc41

  • MD5

    b2f6347c24672f87d6f3225de77deb29

  • SHA1

    e83cce179d31aee6228f6fd5ec3f4b35927e527d

  • SHA256

    88235a4995a5cb37ecec39cafdfa1498c69b43f8f9d2d7bf2e683afbe1e6002c

  • SHA512

    8af8929576b21792983e45a38fb58a464533de1c5968208b0b05580b103a3d95544721b7b5215e464de95f4049833aa23e85201e600a7bfe8220aa314848b534

  • SSDEEP

    12288:LQab4j0WxHHxvgZ5Debn9XdvVYf8tn5+qqheFgOkx2LIa:svj0oxv2Dezv/tx3yOkx2LF

Score
10/10

Malware Config

Targets

    • Target

      88235a4995a5cb37ecec39cafdfa1498c69b43f8f9d2d7bf2e683afbe1e6002c

    • Size

      536KB

    • MD5

      b2f6347c24672f87d6f3225de77deb29

    • SHA1

      e83cce179d31aee6228f6fd5ec3f4b35927e527d

    • SHA256

      88235a4995a5cb37ecec39cafdfa1498c69b43f8f9d2d7bf2e683afbe1e6002c

    • SHA512

      8af8929576b21792983e45a38fb58a464533de1c5968208b0b05580b103a3d95544721b7b5215e464de95f4049833aa23e85201e600a7bfe8220aa314848b534

    • SSDEEP

      12288:LQab4j0WxHHxvgZ5Debn9XdvVYf8tn5+qqheFgOkx2LIa:svj0oxv2Dezv/tx3yOkx2LF

    Score
    10/10
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks