Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    kok.exe

  • Size

    37.6MB

  • Sample

    240810-zpwjha1hpg

  • MD5

    d3256eb5c7eecb0bb52fbf0ff48456ed

  • SHA1

    e65e7682a5cc1964b6c6934826b992ca52755c0b

  • SHA256

    e760bf30eaf149235f2709475d5bf3251b97fbd363c5b03a4041a7373a004f9f

  • SHA512

    69e53693b3d60a42c5bf48186f03fe9c9c52523dcec38d6319f2cc6b54138aa81c07500ac5ab9779f7ff64446571bda86ca2c4daaa13832051affa5ea2f46016

  • SSDEEP

    786432:M8j+F5XKXAq3xtR5ejbJGO0NT+AtO2wYOBAh2DYthBxgU3mN2joU4LCV8K:DjSdKDxtR5lO0J+AtwsQqgUCI8K

Malware Config

Targets

    • Target

      kok.exe

    • Size

      37.6MB

    • MD5

      d3256eb5c7eecb0bb52fbf0ff48456ed

    • SHA1

      e65e7682a5cc1964b6c6934826b992ca52755c0b

    • SHA256

      e760bf30eaf149235f2709475d5bf3251b97fbd363c5b03a4041a7373a004f9f

    • SHA512

      69e53693b3d60a42c5bf48186f03fe9c9c52523dcec38d6319f2cc6b54138aa81c07500ac5ab9779f7ff64446571bda86ca2c4daaa13832051affa5ea2f46016

    • SSDEEP

      786432:M8j+F5XKXAq3xtR5ejbJGO0NT+AtO2wYOBAh2DYthBxgU3mN2joU4LCV8K:DjSdKDxtR5lO0J+AtwsQqgUCI8K

    • Disables service(s)

    • Modifies Windows Defender Real-time Protection settings

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks