Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
beautiful-fantasy-wallpaper-ultra-hd-wallpaper-4k-sr10012418-1706506236698-cover.png
-
Size
295KB
-
Sample
240805-xgngtavdrl
-
MD5
4555d00284f879169308118fb368a70c
-
SHA1
22c04eab1b1ddbcd17ff7f1edc8e58aa7d8f2270
-
SHA256
8c892da6ff496b2ff80d3722c33bdb2d4141169c5b501d03d69528356f4db0b7
-
SHA512
ed723244e211b64a1b38fb8a8a47323c4ca4e04b52330b7c301c1b9c1d28a4d90a1eefb59410f1ee689b6fc4b7bcc0353550c81e1de27a754ad6ac0a12a241af
-
SSDEEP
6144:LCXFR/CyHaw54M1gU0oCp7IZmFE6YPGj0cAPV4ZLyOTFjuwz:LCXFlCyHZ4MSU0oCiZsTYOTAPUGOluwz
Static task
static1
Behavioral task
behavioral1
Sample
beautiful-fantasy-wallpaper-ultra-hd-wallpaper-4k-sr10012418-1706506236698-cover.png
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
beautiful-fantasy-wallpaper-ultra-hd-wallpaper-4k-sr10012418-1706506236698-cover.png
-
Size
295KB
-
MD5
4555d00284f879169308118fb368a70c
-
SHA1
22c04eab1b1ddbcd17ff7f1edc8e58aa7d8f2270
-
SHA256
8c892da6ff496b2ff80d3722c33bdb2d4141169c5b501d03d69528356f4db0b7
-
SHA512
ed723244e211b64a1b38fb8a8a47323c4ca4e04b52330b7c301c1b9c1d28a4d90a1eefb59410f1ee689b6fc4b7bcc0353550c81e1de27a754ad6ac0a12a241af
-
SSDEEP
6144:LCXFR/CyHaw54M1gU0oCp7IZmFE6YPGj0cAPV4ZLyOTFjuwz:LCXFlCyHZ4MSU0oCiZsTYOTAPUGOluwz
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1