Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
sample
-
Size
13KB
-
Sample
240516-vczyyaed43
-
MD5
89f3aebc8900986a2cc6e35670fd6cb8
-
SHA1
8f6aabe3bf3c6ab0ed3d00d4593fef2d8957fade
-
SHA256
bb3ae8fe06418dff8b04a63e0be6874d6e5216857ac055f155bb9b2969f0c521
-
SHA512
e92b855798620492a42f157f27972b519fec88a841ca0a294a7ff1cf81e1f937698244e8e996c4c3b356f4055efc62a8abcd874209733cd4d3807bc17077bb33
-
SSDEEP
192:ftOEds4/H4g3zJ45RsM3VbOeLMxym2ogtxyTQ/yz+qSI/1qRUltyPVVgh3S:1JJ/H4g3MbOeQxZ2htCUqpAPVVghC
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240508-en
Malware Config
Targets
-
-
Target
sample
-
Size
13KB
-
MD5
89f3aebc8900986a2cc6e35670fd6cb8
-
SHA1
8f6aabe3bf3c6ab0ed3d00d4593fef2d8957fade
-
SHA256
bb3ae8fe06418dff8b04a63e0be6874d6e5216857ac055f155bb9b2969f0c521
-
SHA512
e92b855798620492a42f157f27972b519fec88a841ca0a294a7ff1cf81e1f937698244e8e996c4c3b356f4055efc62a8abcd874209733cd4d3807bc17077bb33
-
SSDEEP
192:ftOEds4/H4g3zJ45RsM3VbOeLMxym2ogtxyTQ/yz+qSI/1qRUltyPVVgh3S:1JJ/H4g3MbOeQxZ2htCUqpAPVVghC
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1