Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
EZFNLauncher_BETA_SPRINT_BY_DEFAULT.msi
-
Size
99.8MB
-
Sample
240828-1pv4eaxgpd
-
MD5
87d1849afdfe6f2f77209902e7ea5269
-
SHA1
a39606f33d7e5badf7c442d3530e2764aeded5a4
-
SHA256
fbe04bc9b93124e9f5f21ed32558be778058bdc496291854cbfda57472d8ecba
-
SHA512
b8e0ec1b31845f00b0b1210a0a50bb0d6daa48317597fa8386d1b92fc1645830dbea7f6cf94a4a076f3fe2e659078940754bf87c98cafc9b12fd376563c41365
-
SSDEEP
3145728:MscrBJdkZkc2YmAo/9c8e+eWfTRqZ9gjJvQXU:UrBo2YmAm9LfTRqzgdvQ
Static task
static1
Behavioral task
behavioral1
Sample
EZFNLauncher_BETA_SPRINT_BY_DEFAULT.msi
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
EZFNLauncher_BETA_SPRINT_BY_DEFAULT.msi
-
Size
99.8MB
-
MD5
87d1849afdfe6f2f77209902e7ea5269
-
SHA1
a39606f33d7e5badf7c442d3530e2764aeded5a4
-
SHA256
fbe04bc9b93124e9f5f21ed32558be778058bdc496291854cbfda57472d8ecba
-
SHA512
b8e0ec1b31845f00b0b1210a0a50bb0d6daa48317597fa8386d1b92fc1645830dbea7f6cf94a4a076f3fe2e659078940754bf87c98cafc9b12fd376563c41365
-
SSDEEP
3145728:MscrBJdkZkc2YmAo/9c8e+eWfTRqZ9gjJvQXU:UrBo2YmAm9LfTRqzgdvQ
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
8System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1