Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0a16d46c025c3efe81085f97fdf3bcdd7b2a612c82f057639b0ccf77224da2e8
-
Size
4.1MB
-
Sample
240519-bxl32abe72
-
MD5
1c71d6b9c899a8b7e146663a29d29862
-
SHA1
9cc0e457b26c1ac0d44bb37b5e8ad1ae5fd96b25
-
SHA256
0a16d46c025c3efe81085f97fdf3bcdd7b2a612c82f057639b0ccf77224da2e8
-
SHA512
4fad5f04c9b78c31baae33ea6cc558f73889266e1acc3a75b83b0b8a43db917f0c7f089262b0056f2ce65409017996274c135f3784287a318b1a73f2dda332a7
-
SSDEEP
98304:yf+oTi6061rsx4yGF2uQjPQS21lHMnsqkLrDDcuTdH2a0g7PFf:Bos8riuQnYS21lsngzdH/0gl
Static task
static1
Behavioral task
behavioral1
Sample
0a16d46c025c3efe81085f97fdf3bcdd7b2a612c82f057639b0ccf77224da2e8.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
0a16d46c025c3efe81085f97fdf3bcdd7b2a612c82f057639b0ccf77224da2e8
-
Size
4.1MB
-
MD5
1c71d6b9c899a8b7e146663a29d29862
-
SHA1
9cc0e457b26c1ac0d44bb37b5e8ad1ae5fd96b25
-
SHA256
0a16d46c025c3efe81085f97fdf3bcdd7b2a612c82f057639b0ccf77224da2e8
-
SHA512
4fad5f04c9b78c31baae33ea6cc558f73889266e1acc3a75b83b0b8a43db917f0c7f089262b0056f2ce65409017996274c135f3784287a318b1a73f2dda332a7
-
SSDEEP
98304:yf+oTi6061rsx4yGF2uQjPQS21lHMnsqkLrDDcuTdH2a0g7PFf:Bos8riuQnYS21lsngzdH/0gl
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1