Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5
-
Size
4.2MB
-
Sample
240310-yp5xhaah98
-
MD5
873c6264052761245df6b117738ac825
-
SHA1
855b7550370d5e7ae1e530d1b99cd1103fc0b626
-
SHA256
253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5
-
SHA512
9a8de1df29aa30f86f1b7bd6026b861749828c36c44023ee2ae8d3e5d53ca4561a7d45df34e39caf2deb729698f90bd80f29abc814f33aedb13a4fae7491f698
-
SSDEEP
6144:8cFvrd1rWkNYiclkBw1x42dy8r1YA+ycK23+86JQPDHDdx/QtqV:d1dCicWy1xFc8r1N+ZKlPJQPDHvd
Static task
static1
Behavioral task
behavioral1
Sample
253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5
-
Size
4.2MB
-
MD5
873c6264052761245df6b117738ac825
-
SHA1
855b7550370d5e7ae1e530d1b99cd1103fc0b626
-
SHA256
253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5
-
SHA512
9a8de1df29aa30f86f1b7bd6026b861749828c36c44023ee2ae8d3e5d53ca4561a7d45df34e39caf2deb729698f90bd80f29abc814f33aedb13a4fae7491f698
-
SSDEEP
6144:8cFvrd1rWkNYiclkBw1x42dy8r1YA+ycK23+86JQPDHDdx/QtqV:d1dCicWy1xFc8r1N+ZKlPJQPDHvd
Score10/10-
Modifies WinLogon for persistence
-
Adds policy Run key to start application
-
Disables RegEdit via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1