Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8845ee4284fd4956fd83c87df37ea55e

  • Size

    100KB

  • Sample

    240202-cmcx2sdgam

  • MD5

    8845ee4284fd4956fd83c87df37ea55e

  • SHA1

    958896222f677bbc7960943e6df81b7b3b58e71e

  • SHA256

    3c1295810d131e28d9a12e33aa657da4b62cdc772fa00bc8c6eace33ce1e0192

  • SHA512

    94da99500102ea9ad0ec6012e0fbb43fd4968c2fcafeaf2c4b3988a23eb4410b50c3d8c58a1fe5d80b69315af2ee7c4c98dcfb655837741e194d87af03bb8fe6

  • SSDEEP

    3072:4Vkf6S24thpSNr4LYRL1PA42FKeDGVk8jwaaHw7Koj4rDM9P:4qS6E9eYR5PxS0

Malware Config

Targets

    • Target

      8845ee4284fd4956fd83c87df37ea55e

    • Size

      100KB

    • MD5

      8845ee4284fd4956fd83c87df37ea55e

    • SHA1

      958896222f677bbc7960943e6df81b7b3b58e71e

    • SHA256

      3c1295810d131e28d9a12e33aa657da4b62cdc772fa00bc8c6eace33ce1e0192

    • SHA512

      94da99500102ea9ad0ec6012e0fbb43fd4968c2fcafeaf2c4b3988a23eb4410b50c3d8c58a1fe5d80b69315af2ee7c4c98dcfb655837741e194d87af03bb8fe6

    • SSDEEP

      3072:4Vkf6S24thpSNr4LYRL1PA42FKeDGVk8jwaaHw7Koj4rDM9P:4qS6E9eYR5PxS0

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • UAC bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks