Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/05/2024, 19:13

240502-xw2mzseb6s 8

02/05/2024, 19:06

240502-xr2gesea9w 8

02/05/2024, 19:03

240502-xqgqmaea7w 10

02/05/2024, 18:59

240502-xndwysga69 6

General

  • Target

    بهجت صابر - من ميدان الكسميات ..mp4

  • Size

    1.9MB

  • Sample

    240502-xr2gesea9w

  • MD5

    60134762845141c1071ba1134fa5d712

  • SHA1

    5f93f2ac13f1d2f4de8418b768b7953709c643a6

  • SHA256

    8f76628c5258074c8a43a644bab240c1b6b5d73851831580b328e4f5bec90687

  • SHA512

    2a6951e6601d515c1d84f3d5d81d27866b3df1999f65b341ca1021521a8584182dabfbac342cc68ef159a6e41c42459d5f3d479ed5653f465d51cf7a8391f33d

  • SSDEEP

    49152:54lDV2ACQ8GSpLt9ndqqgtqgtaKOWOHxomZjmQ8Z3:6lDV2ACJpvndPEqghOW0NjmJZ

Malware Config

Targets

    • Target

      بهجت صابر - من ميدان الكسميات ..mp4

    • Size

      1.9MB

    • MD5

      60134762845141c1071ba1134fa5d712

    • SHA1

      5f93f2ac13f1d2f4de8418b768b7953709c643a6

    • SHA256

      8f76628c5258074c8a43a644bab240c1b6b5d73851831580b328e4f5bec90687

    • SHA512

      2a6951e6601d515c1d84f3d5d81d27866b3df1999f65b341ca1021521a8584182dabfbac342cc68ef159a6e41c42459d5f3d479ed5653f465d51cf7a8391f33d

    • SSDEEP

      49152:54lDV2ACQ8GSpLt9ndqqgtqgtaKOWOHxomZjmQ8Z3:6lDV2ACJpvndPEqghOW0NjmJZ

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks