Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.a28a054ef02fad5162ebe58599860d30.exe
-
Size
120KB
-
Sample
231021-1a8e7ahf54
-
MD5
a28a054ef02fad5162ebe58599860d30
-
SHA1
a3a37238132d5bbb43a8fb955d88c9efc660e44a
-
SHA256
162378b57cb5ffc29a00120725e8793f07a93f506783151e21e94b65647d13ba
-
SHA512
7cad2829760e0d8c436d19b2221e7c5977ad509fce4496914aa49c6c26c2b47af1f670bc885d1a665f6ae4707562777510ae46ada44096f3b04373cafc31c15c
-
SSDEEP
3072:n2vg20tu6fiquMnJhgl8K7wPMNIBWGNoo69S2Gx2gt4:IP4u/n9xiB5iSL4gt
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a28a054ef02fad5162ebe58599860d30.dll
Resource
win7-20231020-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
NEAS.a28a054ef02fad5162ebe58599860d30.exe
-
Size
120KB
-
MD5
a28a054ef02fad5162ebe58599860d30
-
SHA1
a3a37238132d5bbb43a8fb955d88c9efc660e44a
-
SHA256
162378b57cb5ffc29a00120725e8793f07a93f506783151e21e94b65647d13ba
-
SHA512
7cad2829760e0d8c436d19b2221e7c5977ad509fce4496914aa49c6c26c2b47af1f670bc885d1a665f6ae4707562777510ae46ada44096f3b04373cafc31c15c
-
SSDEEP
3072:n2vg20tu6fiquMnJhgl8K7wPMNIBWGNoo69S2Gx2gt4:IP4u/n9xiB5iSL4gt
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5