Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923.exe

  • Size

    623KB

  • Sample

    240306-cvcl9age81

  • MD5

    69893879dfb7420cc301c2097d529607

  • SHA1

    f5d0929b50cb25555d6470946f76832a3f6fd13b

  • SHA256

    69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923

  • SHA512

    601665e12a529342586f0f85fe27682b20841a2c62c7ad0f2454d79ac3bc56c647e3f7d3147b3a33dc58b7e549c3e7efc42dbedf73cf5e8357421bc38e826398

  • SSDEEP

    12288:ylR3Rtp9Jt7SEgUceFLX2YRJpNpRyOArULAHW9O9k:Y3Rtp9JamphWALAGOO

Score
8/10

Malware Config

Targets

    • Target

      69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923.exe

    • Size

      623KB

    • MD5

      69893879dfb7420cc301c2097d529607

    • SHA1

      f5d0929b50cb25555d6470946f76832a3f6fd13b

    • SHA256

      69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923

    • SHA512

      601665e12a529342586f0f85fe27682b20841a2c62c7ad0f2454d79ac3bc56c647e3f7d3147b3a33dc58b7e549c3e7efc42dbedf73cf5e8357421bc38e826398

    • SSDEEP

      12288:ylR3Rtp9Jt7SEgUceFLX2YRJpNpRyOArULAHW9O9k:Y3Rtp9JamphWALAGOO

    Score
    7/10
    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      Malemutes/Nonprecedent.Fod

    • Size

      52KB

    • MD5

      d70cc7a86c607e5511048fe2b3242bf9

    • SHA1

      7533500bfb680dc5fcea3e37fd2eca0385990376

    • SHA256

      9be2c4093ac767d9ec1aa035a7a8139fac9347068f303e1ef583b4d1f8dedd2b

    • SHA512

      05052e82d38f94ff7eb6ed89a7fd9041c20d03eba7d6d193c3fe85c628605c70fa8cb2dbb1e44ee721c8143bbcb6e5caf72c24acb134628d967e757b18d158ff

    • SSDEEP

      768:U2QEBkOK0lDYsewm+sJ1IpcWeTsoacVjEiaiEpacvbFDchyck95ipSDqgSVP:H+0lDYqZsbwxrcVjWircjkzk95ip7P

    Score
    8/10
    • Modifies Installed Components in the registry

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks