Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77

  • Size

    2.9MB

  • Sample

    240501-hjm7haac5x

  • MD5

    4cea9711ee6cf7c880c00246253fd14a

  • SHA1

    9f6638447748bf03d2255baa3eff09befe67e5e8

  • SHA256

    ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77

  • SHA512

    9a154d4ea2cb0ca2b40cf6beac9457990800cf7c28171be088b159b5890336f341670bc3bb34b079f713bb9e16501230c4edf0b5ff5531f508ff0bc9b7658ada

  • SSDEEP

    49152:8zBfc7Dt4yQMOEH/QzQSvO6cDEsVDKNxPIJKWNWrblFeeHfJ0JDe4EwgG6qJOr:8zuK2WvxsV2NShNQN/JSZEc2

Malware Config

Targets

    • Target

      ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77

    • Size

      2.9MB

    • MD5

      4cea9711ee6cf7c880c00246253fd14a

    • SHA1

      9f6638447748bf03d2255baa3eff09befe67e5e8

    • SHA256

      ce753b226cf4c5fa1795ca13754d9b9add4cf6752cad6268ca4fd8c95688cc77

    • SHA512

      9a154d4ea2cb0ca2b40cf6beac9457990800cf7c28171be088b159b5890336f341670bc3bb34b079f713bb9e16501230c4edf0b5ff5531f508ff0bc9b7658ada

    • SSDEEP

      49152:8zBfc7Dt4yQMOEH/QzQSvO6cDEsVDKNxPIJKWNWrblFeeHfJ0JDe4EwgG6qJOr:8zuK2WvxsV2NShNQN/JSZEc2

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies firewall policy service

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • UAC bypass

    • Windows security bypass

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Windows security modification

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops Chrome extension

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks