Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e94f26308dd12f33127f38728ca8ec16.exe
-
Size
100KB
-
Sample
240109-xfhvyagccq
-
MD5
e94f26308dd12f33127f38728ca8ec16
-
SHA1
66b06496d6f260cf0861b04b27f1d36a220b6105
-
SHA256
13f10479812e020ad14c2e6a1ee24c1620248ab2871aafd25afbbc156e0c25f6
-
SHA512
2c0c03b0057b2a79ce1e10e7cc86a7767e2402121f217d8fd2800ffa0ea6be409672c7fa91d060269d423d5263041a30b9dc902ba34ffc971ce120f1d51efb61
-
SSDEEP
1536:qlJqRThpHC1+VJON8oVZqziDEwW+B/nibT6Ps0m5itFleF4smyREkz0YjB:2qR68MZq5PH6098FlC4i
Static task
static1
Behavioral task
behavioral1
Sample
e94f26308dd12f33127f38728ca8ec16.exe
Resource
win7-20231215-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
e94f26308dd12f33127f38728ca8ec16.exe
-
Size
100KB
-
MD5
e94f26308dd12f33127f38728ca8ec16
-
SHA1
66b06496d6f260cf0861b04b27f1d36a220b6105
-
SHA256
13f10479812e020ad14c2e6a1ee24c1620248ab2871aafd25afbbc156e0c25f6
-
SHA512
2c0c03b0057b2a79ce1e10e7cc86a7767e2402121f217d8fd2800ffa0ea6be409672c7fa91d060269d423d5263041a30b9dc902ba34ffc971ce120f1d51efb61
-
SSDEEP
1536:qlJqRThpHC1+VJON8oVZqziDEwW+B/nibT6Ps0m5itFleF4smyREkz0YjB:2qR68MZq5PH6098FlC4i
-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5