Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
kok.exe
-
Size
37.6MB
-
Sample
240810-zpwjha1hpg
-
MD5
d3256eb5c7eecb0bb52fbf0ff48456ed
-
SHA1
e65e7682a5cc1964b6c6934826b992ca52755c0b
-
SHA256
e760bf30eaf149235f2709475d5bf3251b97fbd363c5b03a4041a7373a004f9f
-
SHA512
69e53693b3d60a42c5bf48186f03fe9c9c52523dcec38d6319f2cc6b54138aa81c07500ac5ab9779f7ff64446571bda86ca2c4daaa13832051affa5ea2f46016
-
SSDEEP
786432:M8j+F5XKXAq3xtR5ejbJGO0NT+AtO2wYOBAh2DYthBxgU3mN2joU4LCV8K:DjSdKDxtR5lO0J+AtwsQqgUCI8K
Static task
static1
Behavioral task
behavioral1
Sample
kok.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
kok.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
kok.exe
-
Size
37.6MB
-
MD5
d3256eb5c7eecb0bb52fbf0ff48456ed
-
SHA1
e65e7682a5cc1964b6c6934826b992ca52755c0b
-
SHA256
e760bf30eaf149235f2709475d5bf3251b97fbd363c5b03a4041a7373a004f9f
-
SHA512
69e53693b3d60a42c5bf48186f03fe9c9c52523dcec38d6319f2cc6b54138aa81c07500ac5ab9779f7ff64446571bda86ca2c4daaa13832051affa5ea2f46016
-
SSDEEP
786432:M8j+F5XKXAq3xtR5ejbJGO0NT+AtO2wYOBAh2DYthBxgU3mN2joU4LCV8K:DjSdKDxtR5lO0J+AtwsQqgUCI8K
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Change Default File Association
1Power Settings
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Change Default File Association
1