Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

Setup.exe

windows10-2004-x64

7

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$TEMP/Assistant.exe

windows10-2004-x64

1

$TEMP/RunAsAdmin.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    1.6MB

  • Sample

    240307-1saxmsfh9t

  • MD5

    8023237a9b7b9d83e2877178cf79b6da

  • SHA1

    5d41dc9269099c26bc0f6dd4cd57f771fc7809de

  • SHA256

    74363f391dd3c0950e22d250039c3b5f68277229cbcae9656b02dd4a815754db

  • SHA512

    bfa063f40f57675492eb3f73977453de5c7e54643a79d6052cab12b1acb5e9524772f7d68f4a774e62b0f6efa89f153583663e81f2fdd9e49659e2e02951b5d2

  • SSDEEP

    49152:dmxEXgISAuEXRIFkzQtsuIIFksoSgZppYrHt45ddWwO:2lIS8u2QtKQoSWorHt4pI

Score
7/10

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      1.6MB

    • MD5

      8023237a9b7b9d83e2877178cf79b6da

    • SHA1

      5d41dc9269099c26bc0f6dd4cd57f771fc7809de

    • SHA256

      74363f391dd3c0950e22d250039c3b5f68277229cbcae9656b02dd4a815754db

    • SHA512

      bfa063f40f57675492eb3f73977453de5c7e54643a79d6052cab12b1acb5e9524772f7d68f4a774e62b0f6efa89f153583663e81f2fdd9e49659e2e02951b5d2

    • SSDEEP

      49152:dmxEXgISAuEXRIFkzQtsuIIFksoSgZppYrHt45ddWwO:2lIS8u2QtKQoSWorHt4pI

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      d9a3fc12d56726dde60c1ead1df366f7

    • SHA1

      f531768159c14f07ac896437445652b33750a237

    • SHA256

      401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

    • SHA512

      6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

    Score
    3/10
    behavioral2

    • Target

      $TEMP/Assistant.exe

    • Size

      1.5MB

    • MD5

      3f5c6fb5347be277e66b2780317499dc

    • SHA1

      233a757c34b1cf79fecd91ddf50b7ae17b8a921f

    • SHA256

      71a2d19795960b57866f01eb15f3257978d595f593839c2f210d1be00c9ead7f

    • SHA512

      7bc0be2de7e1ddb11f6f3389d6f552cf4349e0c3006f2399b92e1bd3a94773f2c843a10d7cbb51071c7372137c4562a39cb2412d30cf55bc53083d1b10dd8b5f

    • SSDEEP

      49152:vOQub3+LPRBizTB7mmGOSixguQaVGD9ZZT9VYpQ9Up03k2h6Et03K:vOQU+LLizN7mmGOSixgy09ZZxGBX2h6l

    Score
    1/10
    behavioral3

    • Target

      $TEMP/RunAsAdmin.exe

    • Size

      1.6MB

    • MD5

      0b53be7581d492020324fba0be82853e

    • SHA1

      c5aad14b92983b9ebc6c407461132664cd9d8f5d

    • SHA256

      43cd5d0c17842f854afb71b4691c3f04f158f143d89d8f184ac4d8754dc91da2

    • SHA512

      d241f27475ce0deffdb2d62a515903cf8b923d683a521025eab7db87fddb5a457d8ee7d77d4b0aa765a3b05192e24aa4e9bd5bcebe37bfed76e8132dece4af59

    • SSDEEP

      49152:ybibX2skhQ3i2YAMptZS6wtbwIkFkw5nJJvOEuTg1dj/MnR7oNah1J2:yqX2PhQ3LYTtZ6tbwFFkwZJJvOEu0A79

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral4

MITRE ATT&CK Enterprise v15

Tasks