Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

test.txt

windows11-21h2-x64

8

Resubmissions

21/02/2024, 20:07

240221-yweznafc43 8

21/02/2024, 20:07

240221-yv7y2seg2t 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.txt

  • Size

    21B

  • Sample

    240221-yweznafc43

  • MD5

    fc9ddef617fec34b8b42440f3bc37bf6

  • SHA1

    fb2971679cc6db742308da823d345d3c5490aa4b

  • SHA256

    0125727b31f12d13195afb8efe7862e163ad405496a50c63f921924165117962

  • SHA512

    52f410311c42999686bf83f6483f8f22b197c39452ec71af15810ac8ac8903a15b70ba8c90d549cea8fe11ea6eb19ec3cd2ea39f999d0cebee09e0536276a9e2

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      test.txt

    • Size

      21B

    • MD5

      fc9ddef617fec34b8b42440f3bc37bf6

    • SHA1

      fb2971679cc6db742308da823d345d3c5490aa4b

    • SHA256

      0125727b31f12d13195afb8efe7862e163ad405496a50c63f921924165117962

    • SHA512

      52f410311c42999686bf83f6483f8f22b197c39452ec71af15810ac8ac8903a15b70ba8c90d549cea8fe11ea6eb19ec3cd2ea39f999d0cebee09e0536276a9e2

    Score
    8/10
    bootkitpersistence

    • Downloads MZ/PE file

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks