Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1974708e1f31870067fad19e4edaffc9ba518557de0a7abce780a948660689f7

  • Size

    4.2MB

  • Sample

    240425-sxx9qscb25

  • MD5

    941ef1463d66f6f76ab88767249145be

  • SHA1

    7308765c8769a3f6486028af9466d5327581a169

  • SHA256

    1974708e1f31870067fad19e4edaffc9ba518557de0a7abce780a948660689f7

  • SHA512

    30065f20996298802602d3ff0a0c48e7a69e4c136abf1fe26dba5f8b5b6705b61f83638bf870bc3be65fad83ac9799982f7a6f4e0f47c9e6031f5f64b2f7fb49

  • SSDEEP

    98304:K+8Pj1ZT6Vr0wZqa219A2D71J0S/rwUCjvn1rKajWGkWvy/KS6wUa/y:KpTT62wIa89A2D71N/UUOgaSZKqUAy

Malware Config

Targets

    • Target

      1974708e1f31870067fad19e4edaffc9ba518557de0a7abce780a948660689f7

    • Size

      4.2MB

    • MD5

      941ef1463d66f6f76ab88767249145be

    • SHA1

      7308765c8769a3f6486028af9466d5327581a169

    • SHA256

      1974708e1f31870067fad19e4edaffc9ba518557de0a7abce780a948660689f7

    • SHA512

      30065f20996298802602d3ff0a0c48e7a69e4c136abf1fe26dba5f8b5b6705b61f83638bf870bc3be65fad83ac9799982f7a6f4e0f47c9e6031f5f64b2f7fb49

    • SSDEEP

      98304:K+8Pj1ZT6Vr0wZqa219A2D71J0S/rwUCjvn1rKajWGkWvy/KS6wUa/y:KpTT62wIa89A2D71N/UUOgaSZKqUAy

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks