Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e696d8b3afdc0cb47f204ff8cf259b32127b9389e99740fd4c6fa08e4664b889
-
Size
4.1MB
-
Sample
240516-pyy1wadf99
-
MD5
82f516461e7545486763518f7dbb6214
-
SHA1
18d75fa4a95ea8cd9d2db5aa79588d86ed26f912
-
SHA256
e696d8b3afdc0cb47f204ff8cf259b32127b9389e99740fd4c6fa08e4664b889
-
SHA512
96b9a6781902f6b0ad3b357d92317938d77550448ce9afb0fc58e806a411c017f2c8173dd5ec795df74d668affde0d06f83bfee008381d5f9a73349ce6e5caed
-
SSDEEP
98304:sl9GTbLtL99uWlQGfUFGGhNMfnjCzwWu2csDCx3z+ti:xT3oWlQMUAMlWxj+ti
Static task
static1
Behavioral task
behavioral1
Sample
e696d8b3afdc0cb47f204ff8cf259b32127b9389e99740fd4c6fa08e4664b889.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
e696d8b3afdc0cb47f204ff8cf259b32127b9389e99740fd4c6fa08e4664b889
-
Size
4.1MB
-
MD5
82f516461e7545486763518f7dbb6214
-
SHA1
18d75fa4a95ea8cd9d2db5aa79588d86ed26f912
-
SHA256
e696d8b3afdc0cb47f204ff8cf259b32127b9389e99740fd4c6fa08e4664b889
-
SHA512
96b9a6781902f6b0ad3b357d92317938d77550448ce9afb0fc58e806a411c017f2c8173dd5ec795df74d668affde0d06f83bfee008381d5f9a73349ce6e5caed
-
SSDEEP
98304:sl9GTbLtL99uWlQGfUFGGhNMfnjCzwWu2csDCx3z+ti:xT3oWlQMUAMlWxj+ti
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1