Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

VisualStudioSetup.exe

windows11-21h2-x64

10

Resubmissions

25/08/2024, 01:29

240825-bwbwnssemq 10

25/08/2024, 00:08

240825-ae1b9sxcre 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VisualStudioSetup.exe

  • Size

    4.2MB

  • Sample

    240825-bwbwnssemq

  • MD5

    e62b3d678739012ff21131b393e6eb6a

  • SHA1

    406a98376777e0366d7aeeea635e3bea2155006b

  • SHA256

    99a1e6a5c33d6ca8d7b308002a10d729bd8926afdf771a6b2c7a6f2e1c6af905

  • SHA512

    81ae566ee82fdce6700049923da4cfe5886d9c9ca82293744db1ed7cca5232a265cf620dbc03821f9f970a03318ccc867533489209f14647e916c1aa262ec733

  • SSDEEP

    98304:HEbiyM/1hbHw48psbOgCkrhZg7wKhaaKabT:AqhbQtC7rAwXy

Score
10/10
adwarecredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      VisualStudioSetup.exe

    • Size

      4.2MB

    • MD5

      e62b3d678739012ff21131b393e6eb6a

    • SHA1

      406a98376777e0366d7aeeea635e3bea2155006b

    • SHA256

      99a1e6a5c33d6ca8d7b308002a10d729bd8926afdf771a6b2c7a6f2e1c6af905

    • SHA512

      81ae566ee82fdce6700049923da4cfe5886d9c9ca82293744db1ed7cca5232a265cf620dbc03821f9f970a03318ccc867533489209f14647e916c1aa262ec733

    • SSDEEP

      98304:HEbiyM/1hbHw48psbOgCkrhZg7wKhaaKabT:AqhbQtC7rAwXy

    Score
    10/10
    adwarecredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies Windows Firewall

      evasion

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Modifies WinLogon for persistence

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Browser Extensions

1
T1176

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

3
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

3
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Safe Mode Boot

1
T1562.009

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

9
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Peripheral Device Discovery

2
T1120

Query Registry

7
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Tasks