Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

  • Size

    26.5MB

  • Sample

    231114-xjyessee6t

  • MD5

    970f1757ccc0b60859d23302688359ee

  • SHA1

    bbe7be423ba59b0e9872d4f8556b8a9f89d46204

  • SHA256

    0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

  • SHA512

    ca1e1b4a018c730391b90b7b235932bc87b1aa331c1c8327d1aa510cb0c6eb49e7ed110703ae8b2c41e54c1f066d51fa691aff3e09c5cc7a22c3195bce23ff47

  • SSDEEP

    6144:O3Te8ySm8hQAAIfFrRXuEE+0l97mKwKArOHV3j86JQPDHDdx/Qtqa:B/zkFF+EExZmKbciVTPJQPDHvd

Malware Config

Targets

    • Target

      0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

    • Size

      26.5MB

    • MD5

      970f1757ccc0b60859d23302688359ee

    • SHA1

      bbe7be423ba59b0e9872d4f8556b8a9f89d46204

    • SHA256

      0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

    • SHA512

      ca1e1b4a018c730391b90b7b235932bc87b1aa331c1c8327d1aa510cb0c6eb49e7ed110703ae8b2c41e54c1f066d51fa691aff3e09c5cc7a22c3195bce23ff47

    • SSDEEP

      6144:O3Te8ySm8hQAAIfFrRXuEE+0l97mKwKArOHV3j86JQPDHDdx/Qtqa:B/zkFF+EExZmKbciVTPJQPDHvd

    • Modifies WinLogon for persistence

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks