Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8f503a109e77031961be0c791f41c6e0N.exe
-
Size
2.6MB
-
Sample
240825-hpb2essdqp
-
MD5
8f503a109e77031961be0c791f41c6e0
-
SHA1
322e56e5abd3b3f27cbe5d0ae322c9d408a18e78
-
SHA256
c010f5ae0c0614c2077f6f346cc82d850b837aa743ecb62eac197ee7e8964f7b
-
SHA512
86d64819b112a56a1997f48d043e7fc802fd975d935e19538d6799b2c11321486f5370a10351d305e1040f234435657720ecfd61a408121d884b627f38b87075
-
SSDEEP
49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVu:WXzhW148Pd+Tf1mpcOldJQ3/Vu
Behavioral task
behavioral1
Sample
8f503a109e77031961be0c791f41c6e0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8f503a109e77031961be0c791f41c6e0N.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
8f503a109e77031961be0c791f41c6e0N.exe
-
Size
2.6MB
-
MD5
8f503a109e77031961be0c791f41c6e0
-
SHA1
322e56e5abd3b3f27cbe5d0ae322c9d408a18e78
-
SHA256
c010f5ae0c0614c2077f6f346cc82d850b837aa743ecb62eac197ee7e8964f7b
-
SHA512
86d64819b112a56a1997f48d043e7fc802fd975d935e19538d6799b2c11321486f5370a10351d305e1040f234435657720ecfd61a408121d884b627f38b87075
-
SSDEEP
49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVu:WXzhW148Pd+Tf1mpcOldJQ3/Vu
Score10/10-
Modifies visiblity of hidden/system files in Explorer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1