Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

fortinet-7...t1.exe

windows7-x64

6

fortinet-7...t1.exe

windows10-2004-x64

8

Resubmissions

21/02/2024, 18:45 UTC

240221-xeasyaea37 8

21/02/2024, 18:40 UTC

240221-xbnwdsdh48 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fortinet-7.0.0.0029-installer_jLa-0t1.exe

  • Size

    1.7MB

  • Sample

    240221-xeasyaea37

  • MD5

    9402ecd688bb22ae501ee75565e15b4d

  • SHA1

    5671c2706b73f9a68c20a8b41702e9fd161ae240

  • SHA256

    34278d6fd8874bc12cd7498ded79852c87219e7d5d9ca75facfa3deb98089f36

  • SHA512

    f43256d5e52750269679f95311fb097c555f92c0e61779f29e2a2d4dbc55c91c8dbb8fad8ecf5c0643ce650b7e85053d065a1f5779b3a463868a2fa92e294ec0

  • SSDEEP

    24576:C4nXubIQGyxbPV0db26WKas4/Xnna2AVFwCGRjICE2lfWW0qXgoW1zSB:Cqe3f6mson6fNCNltv

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      fortinet-7.0.0.0029-installer_jLa-0t1.exe

    • Size

      1.7MB

    • MD5

      9402ecd688bb22ae501ee75565e15b4d

    • SHA1

      5671c2706b73f9a68c20a8b41702e9fd161ae240

    • SHA256

      34278d6fd8874bc12cd7498ded79852c87219e7d5d9ca75facfa3deb98089f36

    • SHA512

      f43256d5e52750269679f95311fb097c555f92c0e61779f29e2a2d4dbc55c91c8dbb8fad8ecf5c0643ce650b7e85053d065a1f5779b3a463868a2fa92e294ec0

    • SSDEEP

      24576:C4nXubIQGyxbPV0db26WKas4/Xnna2AVFwCGRjICE2lfWW0qXgoW1zSB:Cqe3f6mson6fNCNltv

    Score
    8/10
    discoverypersistencespywarestealerupx

    • Creates new service(s)

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

6
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.