Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    TubeRank Jeet Ai Pro ChatGPT Plus Full Activated.exe

  • Size

    88.2MB

  • Sample

    240813-ter6faxern

  • MD5

    1416efe71f62c25c47cedd41cc137586

  • SHA1

    80d9fafead25fe001b19760489799de3b87d2ef3

  • SHA256

    23f5ba8c7ec73c45f074138b8c09da7003d1d3c4bea3b2546755d52d583f8775

  • SHA512

    f33750d988d4de97e684764098c9bdce93718037e8055c91ea0ea4c21026c6f05ff39689724ca65eb57ee0ac200f889eea64f9e322b53811e0c73c0a3776c03d

  • SSDEEP

    1572864:zHFJUiSrCADbY2qkOMaIuU5AGUe8EBig/q6VBD7VDBScTFU0OtZd1u:TFKiS+KJqkRd/8gd/x3FYGFH

Malware Config

Targets

    • Target

      TubeRank Jeet Ai Pro ChatGPT Plus Full Activated.exe

    • Size

      88.2MB

    • MD5

      1416efe71f62c25c47cedd41cc137586

    • SHA1

      80d9fafead25fe001b19760489799de3b87d2ef3

    • SHA256

      23f5ba8c7ec73c45f074138b8c09da7003d1d3c4bea3b2546755d52d583f8775

    • SHA512

      f33750d988d4de97e684764098c9bdce93718037e8055c91ea0ea4c21026c6f05ff39689724ca65eb57ee0ac200f889eea64f9e322b53811e0c73c0a3776c03d

    • SSDEEP

      1572864:zHFJUiSrCADbY2qkOMaIuU5AGUe8EBig/q6VBD7VDBScTFU0OtZd1u:TFKiS+KJqkRd/8gd/x3FYGFH

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks