Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NAKED_CONE_GIRL.exe
-
Size
923KB
-
Sample
240616-wsxzys1ere
-
MD5
af8087535fd44a2097cf0eef7ea2a985
-
SHA1
cb57127b81f8791567d5ebd9cf7d65c5b774555d
-
SHA256
a028e902f1fb9ceb3add1c1d2cd632327d0423cdf84690c98e38c51aaf51bec5
-
SHA512
48f0fa4324c4f7b28318b4c79cd9cd4fe2292b2bdeab11228b98ccff1d1812d2008f727d856db67ac26fec5f53807e639546c38de96df8de18a80cb2cbe288e5
-
SSDEEP
24576:gVWu3h5OmkY70pdP+uZYwiQteGUIjBdVa6dCD5FZ9f:gV/3h5ln2dmuZYtkeGfjBLELZ
Behavioral task
behavioral1
Sample
NAKED_CONE_GIRL.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
NAKED_CONE_GIRL.exe
-
Size
923KB
-
MD5
af8087535fd44a2097cf0eef7ea2a985
-
SHA1
cb57127b81f8791567d5ebd9cf7d65c5b774555d
-
SHA256
a028e902f1fb9ceb3add1c1d2cd632327d0423cdf84690c98e38c51aaf51bec5
-
SHA512
48f0fa4324c4f7b28318b4c79cd9cd4fe2292b2bdeab11228b98ccff1d1812d2008f727d856db67ac26fec5f53807e639546c38de96df8de18a80cb2cbe288e5
-
SSDEEP
24576:gVWu3h5OmkY70pdP+uZYwiQteGUIjBdVa6dCD5FZ9f:gV/3h5ln2dmuZYtkeGfjBLELZ
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1