Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
https://farming-simulator-22.en.softonic.com/?psafe_param=1&utm_source=SEM&utm_medium=paid&utm_campaign=Google_US_Categories_DSA_CPA&utm_source=SEM&utm_medium=paid&utm_campaign=Google_US_Categories_DSA_CPA&gad_source=1&gclid=Cj0KCQjwh7K1BhCZARIsAKOrVqHlxV3z6C7721XEY6h184gxhAF6u19-Cx7bh-sSO7Ws6WAhcMDmEuEaAgHoEALw_wcB
-
Sample
240802-znzvjavclh
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://farming-simulator-22.en.softonic.com/?psafe_param=1&utm_source=SEM&utm_medium=paid&utm_campaign=Google_US_Categories_DSA_CPA&utm_source=SEM&utm_medium=paid&utm_campaign=Google_US_Categories_DSA_CPA&gad_source=1&gclid=Cj0KCQjwh7K1BhCZARIsAKOrVqHlxV3z6C7721XEY6h184gxhAF6u19-Cx7bh-sSO7Ws6WAhcMDmEuEaAgHoEALw_wcB
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
https://farming-simulator-22.en.softonic.com/?psafe_param=1&utm_source=SEM&utm_medium=paid&utm_campaign=Google_US_Categories_DSA_CPA&utm_source=SEM&utm_medium=paid&utm_campaign=Google_US_Categories_DSA_CPA&gad_source=1&gclid=Cj0KCQjwh7K1BhCZARIsAKOrVqHlxV3z6C7721XEY6h184gxhAF6u19-Cx7bh-sSO7Ws6WAhcMDmEuEaAgHoEALw_wcB
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies WinLogon
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5