Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

  • Size

    2.0MB

  • Sample

    240818-q2dpsawcpe

  • MD5

    a6dfa21610948c33426dd4cb689e060e

  • SHA1

    86d0f9265cbb7cb3eef70fd10fc25143fe1592ca

  • SHA256

    4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

  • SHA512

    bcef93060472971c961997fdea0ead573d01d8c81c6f29f19fe581df33220295650ce2574a97dbc034d7642db77450442585ca8e8982b9eb339a2ca4dead5635

  • SSDEEP

    49152:DCqEdrs/oMaIbycp34Kd9lz04CMxD23I4TsY5l264VfdHW9:Dkd4xIs9tcMye64Vfs9

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.online-secure-pay.info/?0=112&1=1&2=1&3=33&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=skbkyyehvc&14=1

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.online-secure-pay.info/?0=112&1=1&2=1&3=33&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=njkvhbkmrs&14=1

Targets

    • Target

      4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

    • Size

      2.0MB

    • MD5

      a6dfa21610948c33426dd4cb689e060e

    • SHA1

      86d0f9265cbb7cb3eef70fd10fc25143fe1592ca

    • SHA256

      4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

    • SHA512

      bcef93060472971c961997fdea0ead573d01d8c81c6f29f19fe581df33220295650ce2574a97dbc034d7642db77450442585ca8e8982b9eb339a2ca4dead5635

    • SSDEEP

      49152:DCqEdrs/oMaIbycp34Kd9lz04CMxD23I4TsY5l264VfdHW9:Dkd4xIs9tcMye64Vfs9

    • Disables service(s)

    • UAC bypass

    • Disables taskbar notifications via registry modification

    • Event Triggered Execution: Image File Execution Options Injection

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks