Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9e95a2f30e9621a865f2dfc65dc24673.bin
-
Size
4.0MB
-
Sample
240509-dp9v8sfc9z
-
MD5
170a0e7de0b58c535a376ef9e6ca901f
-
SHA1
97209139eb24c9f466b8f15b7df937ccc294a6b8
-
SHA256
777b5c30ab4b22100bb6666499d715839994aa8803fa5c9ed0b6f09ab231a08b
-
SHA512
b0670b1e9527ea573375ffa0790f17504dfa8adc2149fa8535c0d10cd7697997148cd6fab23213379836d52ff56f0847f61e99daf53552be4010c5036dc5c050
-
SSDEEP
98304:DEPn9D2BA1RHZJNWnNjsREWaX7FUlKX4mHL5Q05xuBeegznOOy:EnocjNONIEWmg0q05x8Tgzhy
Static task
static1
Behavioral task
behavioral1
Sample
52a39ad858c97ff0fd70f58eb0efbd6bd41e27f19872cd585370e5e2583c2a78.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
52a39ad858c97ff0fd70f58eb0efbd6bd41e27f19872cd585370e5e2583c2a78.exe
-
Size
4.2MB
-
MD5
9e95a2f30e9621a865f2dfc65dc24673
-
SHA1
c25c03c225709bff58f0fca6bf93c17b28a99aca
-
SHA256
52a39ad858c97ff0fd70f58eb0efbd6bd41e27f19872cd585370e5e2583c2a78
-
SHA512
478eb0640bb5584842d3f8bc00ac7b575f345fc3e70cf04f3b272bf2487af898cbb2f82522b994a7e858bfdc78df89facae968cf6a775c972a5d387710f52e5e
-
SSDEEP
98304:gX+V5iS4211ab8CRU3jj44988X/pz+96Jas+tdDDO/yqmS:gX+V57421108CyI18UwwtdkmS
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1