Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1f1062b09aeb776b65fb5c77e11f267e

  • Size

    287KB

  • Sample

    231230-2tykrsffcn

  • MD5

    1f1062b09aeb776b65fb5c77e11f267e

  • SHA1

    2c3c0136456bbe96921ce89f09c9a76f3e8d44ab

  • SHA256

    ec084fde2bc14fbfee8cc2a1b6f9c21b7aa5ab69f1172cdee6206aaa7e8f795c

  • SHA512

    7d860b3423e10ce0949bdd41cb1fd0fd873f16b5edf8b49d1ec607e66555e0c3d1a8503611280dc3d4c49d761997e5d9d74d97685e40bbde01d2cfbb45bc267f

  • SSDEEP

    6144:0/2MRXFyS71OZz+2e92RM0gOALzsbRHkUuruxFstiVclw8bIELXR2neoS:uFFyS71OZz+nTOALobRHkUxFskVcq8tp

Malware Config

Targets

    • Target

      1f1062b09aeb776b65fb5c77e11f267e

    • Size

      287KB

    • MD5

      1f1062b09aeb776b65fb5c77e11f267e

    • SHA1

      2c3c0136456bbe96921ce89f09c9a76f3e8d44ab

    • SHA256

      ec084fde2bc14fbfee8cc2a1b6f9c21b7aa5ab69f1172cdee6206aaa7e8f795c

    • SHA512

      7d860b3423e10ce0949bdd41cb1fd0fd873f16b5edf8b49d1ec607e66555e0c3d1a8503611280dc3d4c49d761997e5d9d74d97685e40bbde01d2cfbb45bc267f

    • SSDEEP

      6144:0/2MRXFyS71OZz+2e92RM0gOALzsbRHkUuruxFstiVclw8bIELXR2neoS:uFFyS71OZz+nTOALobRHkUxFskVcq8tp

    • Sets DLL path for service in the registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks