Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3c29b2a85beb671f0504afc7c3e1346a
-
Size
12.5MB
-
Sample
240101-hkelraddcj
-
MD5
3c29b2a85beb671f0504afc7c3e1346a
-
SHA1
4db3c724d1d4377bcb85ed2d625ef23867308ce9
-
SHA256
38d1de62b07f072de9aab3a81d82d3066eadf97a016504e7188864f29328b6c2
-
SHA512
89668f1629ea80ec2ebe9e754327abd34bb2b4ffbe75afdf4fe0c50a3e0198f64bf8b8fd95a9752254bc998e751edef0db9a7cf148a5c96946c98bba3cd9311f
-
SSDEEP
24576:ojDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:onh
Static task
static1
Behavioral task
behavioral1
Sample
3c29b2a85beb671f0504afc7c3e1346a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c29b2a85beb671f0504afc7c3e1346a.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Targets
-
-
Target
3c29b2a85beb671f0504afc7c3e1346a
-
Size
12.5MB
-
MD5
3c29b2a85beb671f0504afc7c3e1346a
-
SHA1
4db3c724d1d4377bcb85ed2d625ef23867308ce9
-
SHA256
38d1de62b07f072de9aab3a81d82d3066eadf97a016504e7188864f29328b6c2
-
SHA512
89668f1629ea80ec2ebe9e754327abd34bb2b4ffbe75afdf4fe0c50a3e0198f64bf8b8fd95a9752254bc998e751edef0db9a7cf148a5c96946c98bba3cd9311f
-
SSDEEP
24576:ojDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB3:onh
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2