Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d
-
Size
231KB
-
Sample
240825-grk7fazeqm
-
MD5
5b2c1302039d496f0f970f559b201dfe
-
SHA1
796d10701e5d1dc3e49119322cabc46c5619d272
-
SHA256
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d
-
SHA512
5a685fe98463e7150dbd23cd5ad01c12ccadb03d5eab16099bc0e34d04cd524dcf5be2d2e41a0b0f525242d0539a95d9fcb93dae140291a1ee994c478768e708
-
SSDEEP
6144:9PIeJarlToZNDlkPNvabl9uxX0Xp85VBLc4vm+fbcn8Klh3vOCU:9QxX0Xp8lc428EJ4
Static task
static1
Behavioral task
behavioral1
Sample
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt
cerber
http://52uo5k3t73ypjije.a2uzpe.top/352A-6370-B700-0073-3E17
http://52uo5k3t73ypjije.go8hpw.top/352A-6370-B700-0073-3E17
http://52uo5k3t73ypjije.n6kswi.top/352A-6370-B700-0073-3E17
http://52uo5k3t73ypjije.1bipa9.top/352A-6370-B700-0073-3E17
http://52uo5k3t73ypjije.onion.to/352A-6370-B700-0073-3E17
http://52uo5k3t73ypjije.onion/352A-6370-B700-0073-3E17
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.html
Extracted
C:\Users\Admin\# DECRYPT MY FILES #.txt
cerber
http://52uo5k3t73ypjije.a2uzpe.top/7096-5DD8-492E-0073-3BFE
http://52uo5k3t73ypjije.go8hpw.top/7096-5DD8-492E-0073-3BFE
http://52uo5k3t73ypjije.n6kswi.top/7096-5DD8-492E-0073-3BFE
http://52uo5k3t73ypjije.1bipa9.top/7096-5DD8-492E-0073-3BFE
http://52uo5k3t73ypjije.onion.to/7096-5DD8-492E-0073-3BFE
http://52uo5k3t73ypjije.onion/7096-5DD8-492E-0073-3BFE
Extracted
C:\Users\Admin\# DECRYPT MY FILES #.html
Targets
-
-
Target
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d
-
Size
231KB
-
MD5
5b2c1302039d496f0f970f559b201dfe
-
SHA1
796d10701e5d1dc3e49119322cabc46c5619d272
-
SHA256
d77aca4282fed414d70959186372251565abbd29f261219e544d778224dd3a7d
-
SHA512
5a685fe98463e7150dbd23cd5ad01c12ccadb03d5eab16099bc0e34d04cd524dcf5be2d2e41a0b0f525242d0539a95d9fcb93dae140291a1ee994c478768e708
-
SSDEEP
6144:9PIeJarlToZNDlkPNvabl9uxX0Xp85VBLc4vm+fbcn8Klh3vOCU:9QxX0Xp8lc428EJ4
-
Adds policy Run key to start application
-
Contacts a large (517) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Discovery
Browser Information Discovery
1Network Service Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1