Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/06/2024, 01:19

240620-bprzba1blf 10

26/05/2024, 08:27

240526-kclffacd3v 10

General

  • Target

    JaySploit.zip

  • Size

    80.2MB

  • Sample

    240526-kclffacd3v

  • MD5

    6885d747565ddeec228357d52d76960b

  • SHA1

    b90bd7c05dbdf339bb3071d32541bd86d9d1b8a1

  • SHA256

    5888b095ec1f401edce920d33a37cfd0bd0c8443ce688482c2cbaa4679a65bac

  • SHA512

    41cc6d9c442fe61f676448461ffaf6ff558534eba21b1089c0a2a8247a12bb5882d935119eaad04ccd38f927de8c71c0671eec2823b447cf08c33aeeace1227b

  • SSDEEP

    1572864:mBpPDgSYXnxCI6234p1E1bLq3mERMJW9XMutfKVGXs7S6JhBQBojmFq5UO3YFumV:mBpPDgjBCItozc23mEp132S6L9V5UO2Z

Malware Config

Targets

    • Target

      JaySploit.exe

    • Size

      80.5MB

    • MD5

      980f6afd45c4de00bd97c5d067b3175c

    • SHA1

      5e26d2786ba4a74eb4e21852f8fadee6a597e229

    • SHA256

      d39f8469e2fb40c4e614fb95f8b63ce8b5ac883a82374b90cd9ff3def626bfca

    • SHA512

      e093f5c6c5ebcb8c22d5f77d13d48a1834c005f7d2b52a3293318c24999be3b4498db4f9ed1678062e9bec3af47a014970173790aeca70122b3cae1c5c6ec23c

    • SSDEEP

      1572864:LvNBYQ3jQ3Sk8IpG7V+VPhqb+TnE7KjCeePRQvljSvOul/JGZGHkVDWh9/orsVz5:LvNBY+4SkB05awb+Tzu/2wOuNzIS9/Dz

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks