Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d
-
Size
1.7MB
-
Sample
240825-a6mkgs1alj
-
MD5
58a108887f3b8a883ad972f625256851
-
SHA1
e766b827f09a0afa881cbe1b6484710ce33f2bf0
-
SHA256
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d
-
SHA512
4c08d788a287816e86d838dd8ee3bca4c4310d7ed340b9c8e0209f3cfc11fa0c36325058101265527218c16fbe3a3032392df74e530bd6fd84dc7e759b4d6af3
-
SSDEEP
24576:89SQXgnU56Gt4ULYVI8RGwvrK7/ckFLI78cPR:ssnxUU
Behavioral task
behavioral1
Sample
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d
-
Size
1.7MB
-
MD5
58a108887f3b8a883ad972f625256851
-
SHA1
e766b827f09a0afa881cbe1b6484710ce33f2bf0
-
SHA256
7ec06423c9b70938c9da4be3b0cb6aa156bf45213bb95b44f0c352069e72587d
-
SHA512
4c08d788a287816e86d838dd8ee3bca4c4310d7ed340b9c8e0209f3cfc11fa0c36325058101265527218c16fbe3a3032392df74e530bd6fd84dc7e759b4d6af3
-
SSDEEP
24576:89SQXgnU56Gt4ULYVI8RGwvrK7/ckFLI78cPR:ssnxUU
Score10/10-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
7