Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    New_Project_8.png

  • Size

    138KB

  • Sample

    240418-s4a3saaa9x

  • MD5

    c502fe0cf44c58c37260b8c09b0d926e

  • SHA1

    1829128dddd6af4385e516e5478c277086beaf8c

  • SHA256

    1b196e6f126dc29b6f02c4c8b453ef4d01d52c371c9a0fd1a1ea7faf25e69207

  • SHA512

    ad7d52b07df757e66d98a2f8428f35ab1fe98822af3f405b3563d54ca20f43516de0eb457ae46a7beb2152eb3e13f43ba932f208ae6482833c146edd5dea5a80

  • SSDEEP

    3072:oD544AOMQTnEW6wcoKQmzs8RD/+80bqOFplFDmylEzUoBFyy:e5LTEWIoK7zX/AbfplFDmwEI6Uy

Malware Config

Targets

    • Target

      New_Project_8.png

    • Size

      138KB

    • MD5

      c502fe0cf44c58c37260b8c09b0d926e

    • SHA1

      1829128dddd6af4385e516e5478c277086beaf8c

    • SHA256

      1b196e6f126dc29b6f02c4c8b453ef4d01d52c371c9a0fd1a1ea7faf25e69207

    • SHA512

      ad7d52b07df757e66d98a2f8428f35ab1fe98822af3f405b3563d54ca20f43516de0eb457ae46a7beb2152eb3e13f43ba932f208ae6482833c146edd5dea5a80

    • SSDEEP

      3072:oD544AOMQTnEW6wcoKQmzs8RD/+80bqOFplFDmylEzUoBFyy:e5LTEWIoK7zX/AbfplFDmwEI6Uy

    • Downloads MZ/PE file

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks