Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8845ee4284fd4956fd83c87df37ea55e
-
Size
100KB
-
Sample
240202-cmcx2sdgam
-
MD5
8845ee4284fd4956fd83c87df37ea55e
-
SHA1
958896222f677bbc7960943e6df81b7b3b58e71e
-
SHA256
3c1295810d131e28d9a12e33aa657da4b62cdc772fa00bc8c6eace33ce1e0192
-
SHA512
94da99500102ea9ad0ec6012e0fbb43fd4968c2fcafeaf2c4b3988a23eb4410b50c3d8c58a1fe5d80b69315af2ee7c4c98dcfb655837741e194d87af03bb8fe6
-
SSDEEP
3072:4Vkf6S24thpSNr4LYRL1PA42FKeDGVk8jwaaHw7Koj4rDM9P:4qS6E9eYR5PxS0
Static task
static1
Behavioral task
behavioral1
Sample
8845ee4284fd4956fd83c87df37ea55e.exe
Resource
win7-20231215-en
Malware Config
Targets
-
-
Target
8845ee4284fd4956fd83c87df37ea55e
-
Size
100KB
-
MD5
8845ee4284fd4956fd83c87df37ea55e
-
SHA1
958896222f677bbc7960943e6df81b7b3b58e71e
-
SHA256
3c1295810d131e28d9a12e33aa657da4b62cdc772fa00bc8c6eace33ce1e0192
-
SHA512
94da99500102ea9ad0ec6012e0fbb43fd4968c2fcafeaf2c4b3988a23eb4410b50c3d8c58a1fe5d80b69315af2ee7c4c98dcfb655837741e194d87af03bb8fe6
-
SSDEEP
3072:4Vkf6S24thpSNr4LYRL1PA42FKeDGVk8jwaaHw7Koj4rDM9P:4qS6E9eYR5PxS0
-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1