Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
loader-installer.zip
-
Size
16.0MB
-
Sample
240713-z2kb1azcnc
-
MD5
4d6a5d36b22ea96333f0fcd788b7e16f
-
SHA1
df24faa703a60bca625b24dea95d9af7b9dcfeff
-
SHA256
8af1ae8a6d1965b0e4c83ba47f044c2f81c711e33c6c7372b6e815657334726a
-
SHA512
51267b470e536a317a8f31109e1c53ec7589e4212aaf21cacb8e068daac3e67ad7502424cfa4a517b374bfa636cc58d281bc8466781e7ffe7b862190416aa367
-
SSDEEP
393216:keel/JiZeQoAhy6vrJbgwbHFNsl2c5GGZbRE1q:kr6eQoAawPslz5rbK1q
Static task
static1
Behavioral task
behavioral1
Sample
PhysxExt.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
loaderV4.exe
Resource
win10-20240404-en
Malware Config
Targets
-
-
Target
PhysxExt.dll
-
Size
2.9MB
-
MD5
6ff985653d41e8d60bb1293f01729adf
-
SHA1
1ae3086a16a91ea45c06d34071d8b3b87e058804
-
SHA256
224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f
-
SHA512
fd47a81000dcd98adc03d1f45a172c19b2e8aa3c8f13338bda0b00407f7b81b52e0fa9be3f9ef87fb1303231225e83b9dd8c39a0777ee56ccd54abc52d095b87
-
SSDEEP
24576:fZJJSVBjkvvhwVxKKpQgRQ8sUOwDUsHeHfcKtaPRO/o5o4Z/5rLyv+Fe:xJegvvhTKTRcPDqho4F5rLyW4
Score1/10 -
-
-
Target
loaderV4.exe
-
Size
52.5MB
-
MD5
c09e35d7811e7956a23d1546f3657d1a
-
SHA1
14638637ca598640b361b6d41dd60d32e34e3648
-
SHA256
8a7a0dfd2a635200bd2f52de55df0d955374d67dd5946208397fd0b1a0cf9b59
-
SHA512
c932ea658761cd736881cc0007d7930457803e2466ce9d6d56f15f8edd45139d8937ec8d605bd66494c7b1ea5a8c2a4e7714b907a4f5d07e2883f7f75e5e0ca6
-
SSDEEP
393216:YGoGDd8UzAa52L4KEHqms6X9UDZXozjKv1:YGoid8Uka5nKknc91
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1