Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/08/2024, 08:16

240825-j59s3awclq 10

24/08/2024, 22:14

240824-15m3qssekg 6

General

  • Target

    MalwarePremiumReset.zip

  • Size

    1.4MB

  • Sample

    240825-j59s3awclq

  • MD5

    d9fb8ee39f79c96045038ce2044a24b1

  • SHA1

    f02bf1d58d48942bf925248e195d25a8f265c970

  • SHA256

    205d949385e72bfe9fd24568510cbdfa54c460fcfe4f5902df1a58b569c25bd6

  • SHA512

    f6c47211607c447a1b3786809fb81347add865db7bb1ea422ff35e069d865229bc778c6bf1b4e9b77d4c09f1047f0b0bfa8050876f0e3bc32ccce8fbea562962

  • SSDEEP

    24576:kmdUGJkQwCthfyrXclgLrYtzsQhK5u9uGIBWJCoAh98kFyaUN8K4L8iZ2g+g+y:kmmGSyxycSHYt4QE52OoZu/xP2g+Zy

Malware Config

Targets

    • Target

      MalwarePremiumReset.zip

    • Size

      1.4MB

    • MD5

      d9fb8ee39f79c96045038ce2044a24b1

    • SHA1

      f02bf1d58d48942bf925248e195d25a8f265c970

    • SHA256

      205d949385e72bfe9fd24568510cbdfa54c460fcfe4f5902df1a58b569c25bd6

    • SHA512

      f6c47211607c447a1b3786809fb81347add865db7bb1ea422ff35e069d865229bc778c6bf1b4e9b77d4c09f1047f0b0bfa8050876f0e3bc32ccce8fbea562962

    • SSDEEP

      24576:kmdUGJkQwCthfyrXclgLrYtzsQhK5u9uGIBWJCoAh98kFyaUN8K4L8iZ2g+g+y:kmmGSyxycSHYt4QE52OoZu/xP2g+Zy

    Score
    4/10
    • Target

      MBSetup.exe

    • Size

      2.5MB

    • MD5

      8611a0d47266ce8d473d540bd6534ffc

    • SHA1

      8804544c8ac023d89783d3d27b8c00b11dd8cbb4

    • SHA256

      a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143

    • SHA512

      8f4291ebb1b8cb5561b857d3ea2418c503f79b37b201f017d04a3c49746bfdc29abad5cfef3f2ce150fa8163824ac0a649a24386aee4562940d394f6514e4b7c

    • SSDEEP

      49152:OE8I6oEK7uzgRTvnFjStQyfvE0Z3R0nxiIq2dseYGfXH:OE8IjzuzgFt7KtQRq2VXH

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops file in Drivers directory

    • Modifies RDP port number used by Windows

    • Sets service image path in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Impair Defenses: Safe Mode Boot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Target

      Program/MalwarePremiumReset.dll

    • Size

      10KB

    • MD5

      8b462f67fcec8f56f86864039adb1fbd

    • SHA1

      9e27dc542259ce775ac665f6cd40e56abd772a2c

    • SHA256

      c757f729038cc3dddcb8d876d1f3161db3d8352ef3eb3e27277a0be689e55f7b

    • SHA512

      e77b2983face81ca8622ac845acc1e601d197702a586497e059feeb43fae7fd6616b010533562f02a78b599ae46372e20b81a0463a749baff6d1000d8efd25df

    • SSDEEP

      192:QDE9j274l53HJKR3fTskyiwizcE9XFneGt831pp:vNl53HJo3gk/d/pt831p

    Score
    1/10
    • Target

      Program/MalwarePremiumReset.exe

    • Size

      146KB

    • MD5

      2cee840f0c42f48c7e5b0437f93c0ad9

    • SHA1

      6abd4e8ac6490dba10f3e97374c2e3765b238721

    • SHA256

      086647b8e419a1aee26b33772534b80b4efa64ff12d37b64a3441a84bc02e629

    • SHA512

      0858eebb492edcabed476915a31cc8373fd6f815015063f81c88563549b3c97e9c16e10d6dd5d19ef204b3dbdb1d4c4361e6c932c733c8e775bc4da5552271f0

    • SSDEEP

      3072:8czkitvo4BpYN/6mBPry8TXROLdW5m4mUR19OOGN0kD:8A4NCmBPry/N2lOOU

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks