Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
-
Size
4.1MB
-
Sample
240824-3ktqwswcqa
-
MD5
4dd7bd5bc7ad5494b39c033290136207
-
SHA1
aeac40777f86c172d8872643c9c537f53cdf1f5d
-
SHA256
30949949855ec60455a390a5f77ce7eaf52b3917a963a27ecc7dd1946862e852
-
SHA512
483c6099e920c5b36cd052e59b331d720cebbbf242d190c1b5383b5a7a6327abfc45f2311f58332822d4ec6f726722cf4f16f1c61071d10307a9a6a32849df37
-
SSDEEP
98304:0BZc4QcOiOqteN/+G5s5jmL0tipvHYzlgpwS+nqA5:IzOVq29mJmgw0gpwSa
Static task
static1
Malware Config
Targets
-
-
Target
-
Size
4.1MB
-
MD5
4dd7bd5bc7ad5494b39c033290136207
-
SHA1
aeac40777f86c172d8872643c9c537f53cdf1f5d
-
SHA256
30949949855ec60455a390a5f77ce7eaf52b3917a963a27ecc7dd1946862e852
-
SHA512
483c6099e920c5b36cd052e59b331d720cebbbf242d190c1b5383b5a7a6327abfc45f2311f58332822d4ec6f726722cf4f16f1c61071d10307a9a6a32849df37
-
SSDEEP
98304:0BZc4QcOiOqteN/+G5s5jmL0tipvHYzlgpwS+nqA5:IzOVq29mJmgw0gpwSa
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1