Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

04fe04aed1...e4.exe

windows7-x64

10

04fe04aed1...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

  • Size

    488KB

  • Sample

    240823-wr7srs1blm

  • MD5

    628921281af57fbdd02384411c342f0c

  • SHA1

    4a1e9e114248c711bcce05d99044849f4577d7ea

  • SHA256

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

  • SHA512

    42e05b80a7342965643be17cb325857141787d6c910777476dd9f5eb9731317fe15a832973a92f109143ff744bd37043232e162fce0ecbecaad125809f65ee3b

  • SSDEEP

    12288:V/Mi/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VVK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

    • Size

      488KB

    • MD5

      628921281af57fbdd02384411c342f0c

    • SHA1

      4a1e9e114248c711bcce05d99044849f4577d7ea

    • SHA256

      04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

    • SHA512

      42e05b80a7342965643be17cb325857141787d6c910777476dd9f5eb9731317fe15a832973a92f109143ff744bd37043232e162fce0ecbecaad125809f65ee3b

    • SSDEEP

      12288:V/Mi/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VVK2O2HIBEd7M

    Score
    10/10
    discoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.