Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.bf0252fb37b0ea288eb95f7a1efab790.exe
-
Size
120KB
-
Sample
231022-v1dqlsac63
-
MD5
bf0252fb37b0ea288eb95f7a1efab790
-
SHA1
7ec6826af6c96c1eb16407951398578a6795d435
-
SHA256
07f30401b80deb5f5d379207df94bb69da730c9f3c4f55a7e9f9456a3f4c247a
-
SHA512
9a7a63ecba6e9d8cdeda2cdc05ce4c8729a9d3f40984961f3b1efe4c4c342fb112383124dde8312cb082b7ef152b017db84eebea399694457a6c43197d0cadb2
-
SSDEEP
1536:62FwS9Jjdr8umXZWuXEgBAu0xo64IN7QEdTgJo6b0f83TXuPSdtA:62FdRxy7Xloxo64abIA8Ta2
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bf0252fb37b0ea288eb95f7a1efab790.dll
Resource
win7-20230831-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
NEAS.bf0252fb37b0ea288eb95f7a1efab790.exe
-
Size
120KB
-
MD5
bf0252fb37b0ea288eb95f7a1efab790
-
SHA1
7ec6826af6c96c1eb16407951398578a6795d435
-
SHA256
07f30401b80deb5f5d379207df94bb69da730c9f3c4f55a7e9f9456a3f4c247a
-
SHA512
9a7a63ecba6e9d8cdeda2cdc05ce4c8729a9d3f40984961f3b1efe4c4c342fb112383124dde8312cb082b7ef152b017db84eebea399694457a6c43197d0cadb2
-
SSDEEP
1536:62FwS9Jjdr8umXZWuXEgBAu0xo64IN7QEdTgJo6b0f83TXuPSdtA:62FdRxy7Xloxo64abIA8Ta2
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5