Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
MalwarePremiumReset.zip
-
Size
1.4MB
-
Sample
240825-j59s3awclq
-
MD5
d9fb8ee39f79c96045038ce2044a24b1
-
SHA1
f02bf1d58d48942bf925248e195d25a8f265c970
-
SHA256
205d949385e72bfe9fd24568510cbdfa54c460fcfe4f5902df1a58b569c25bd6
-
SHA512
f6c47211607c447a1b3786809fb81347add865db7bb1ea422ff35e069d865229bc778c6bf1b4e9b77d4c09f1047f0b0bfa8050876f0e3bc32ccce8fbea562962
-
SSDEEP
24576:kmdUGJkQwCthfyrXclgLrYtzsQhK5u9uGIBWJCoAh98kFyaUN8K4L8iZ2g+g+y:kmmGSyxycSHYt4QE52OoZu/xP2g+Zy
Static task
static1
Behavioral task
behavioral1
Sample
MalwarePremiumReset.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Program/MalwarePremiumReset.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Program/MalwarePremiumReset.exe
Resource
win10-20240404-en
Malware Config
Targets
-
-
Target
MalwarePremiumReset.zip
-
Size
1.4MB
-
MD5
d9fb8ee39f79c96045038ce2044a24b1
-
SHA1
f02bf1d58d48942bf925248e195d25a8f265c970
-
SHA256
205d949385e72bfe9fd24568510cbdfa54c460fcfe4f5902df1a58b569c25bd6
-
SHA512
f6c47211607c447a1b3786809fb81347add865db7bb1ea422ff35e069d865229bc778c6bf1b4e9b77d4c09f1047f0b0bfa8050876f0e3bc32ccce8fbea562962
-
SSDEEP
24576:kmdUGJkQwCthfyrXclgLrYtzsQhK5u9uGIBWJCoAh98kFyaUN8K4L8iZ2g+g+y:kmmGSyxycSHYt4QE52OoZu/xP2g+Zy
Score4/10 -
-
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
8611a0d47266ce8d473d540bd6534ffc
-
SHA1
8804544c8ac023d89783d3d27b8c00b11dd8cbb4
-
SHA256
a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143
-
SHA512
8f4291ebb1b8cb5561b857d3ea2418c503f79b37b201f017d04a3c49746bfdc29abad5cfef3f2ce150fa8163824ac0a649a24386aee4562940d394f6514e4b7c
-
SSDEEP
49152:OE8I6oEK7uzgRTvnFjStQyfvE0Z3R0nxiIq2dseYGfXH:OE8IjzuzgFt7KtQRq2VXH
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops file in Drivers directory
-
Modifies RDP port number used by Windows
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Impair Defenses: Safe Mode Boot
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
-
-
Target
Program/MalwarePremiumReset.dll
-
Size
10KB
-
MD5
8b462f67fcec8f56f86864039adb1fbd
-
SHA1
9e27dc542259ce775ac665f6cd40e56abd772a2c
-
SHA256
c757f729038cc3dddcb8d876d1f3161db3d8352ef3eb3e27277a0be689e55f7b
-
SHA512
e77b2983face81ca8622ac845acc1e601d197702a586497e059feeb43fae7fd6616b010533562f02a78b599ae46372e20b81a0463a749baff6d1000d8efd25df
-
SSDEEP
192:QDE9j274l53HJKR3fTskyiwizcE9XFneGt831pp:vNl53HJo3gk/d/pt831p
Score1/10 -
-
-
Target
Program/MalwarePremiumReset.exe
-
Size
146KB
-
MD5
2cee840f0c42f48c7e5b0437f93c0ad9
-
SHA1
6abd4e8ac6490dba10f3e97374c2e3765b238721
-
SHA256
086647b8e419a1aee26b33772534b80b4efa64ff12d37b64a3441a84bc02e629
-
SHA512
0858eebb492edcabed476915a31cc8373fd6f815015063f81c88563549b3c97e9c16e10d6dd5d19ef204b3dbdb1d4c4361e6c932c733c8e775bc4da5552271f0
-
SSDEEP
3072:8czkitvo4BpYN/6mBPry8TXROLdW5m4mUR19OOGN0kD:8A4NCmBPry/N2lOOU
Score1/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1