Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
288c47bbc1871b439df19ff4df68f07776.exe
-
Size
4.5MB
-
Sample
240228-qmlf3sce61
-
MD5
2c7078b90caee9d791dd338c2441ca32
-
SHA1
56901d99127fd701353ab7c68e66c94c49eb507c
-
SHA256
8ad20c4b4c312feb468a58d1748c0d7abba3dd2d0fb8e6bfbee837c47a0e8c5a
-
SHA512
000d81908bc2df1f09fcbf0ac50c72079064923f23fbea2ee0868590eaf693dff4246bb0090083aaec6f031b11353147393b710f72cd1e3630c2ecd071401ef6
-
SSDEEP
98304:5LGSrOpzjhc9lEoupup/jJ1hPE73PGV6F8bnYFc+x69kDP83i:kdjK9lZuEprhEjC7Y69+Pmi
Static task
static1
Behavioral task
behavioral1
Sample
288c47bbc1871b439df19ff4df68f07776.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
288c47bbc1871b439df19ff4df68f07776.exe
-
Size
4.5MB
-
MD5
2c7078b90caee9d791dd338c2441ca32
-
SHA1
56901d99127fd701353ab7c68e66c94c49eb507c
-
SHA256
8ad20c4b4c312feb468a58d1748c0d7abba3dd2d0fb8e6bfbee837c47a0e8c5a
-
SHA512
000d81908bc2df1f09fcbf0ac50c72079064923f23fbea2ee0868590eaf693dff4246bb0090083aaec6f031b11353147393b710f72cd1e3630c2ecd071401ef6
-
SSDEEP
98304:5LGSrOpzjhc9lEoupup/jJ1hPE73PGV6F8bnYFc+x69kDP83i:kdjK9lZuEprhEjC7Y69+Pmi
-
Glupteba payload
-
XMRig Miner payload
-
Modifies boot configuration data using bcdedit
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1