Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    My Logo.txt

  • Size

    543B

  • Sample

    240111-w315csefb8

  • MD5

    6b21e0e4be568a6ba996d759d8a83b4d

  • SHA1

    b04752cf1150e012658cdc96fc073f0863e3941f

  • SHA256

    93d4258ce0ca181aad31176e74d2443d7744acbed5e770546efd6410f7486c5b

  • SHA512

    234fe5ffdb641e44c8bb3728888fcdd8ae6181dc2ffe2511a9ded4121ca1fd0eb2de6fc1dca38566b7987f147689e88d5d35abaf480ad9566b259f885eccb638

Malware Config

Targets

    • Target

      My Logo.txt

    • Size

      543B

    • MD5

      6b21e0e4be568a6ba996d759d8a83b4d

    • SHA1

      b04752cf1150e012658cdc96fc073f0863e3941f

    • SHA256

      93d4258ce0ca181aad31176e74d2443d7744acbed5e770546efd6410f7486c5b

    • SHA512

      234fe5ffdb641e44c8bb3728888fcdd8ae6181dc2ffe2511a9ded4121ca1fd0eb2de6fc1dca38566b7987f147689e88d5d35abaf480ad9566b259f885eccb638

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks