Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Delta V3.61 b_49450291.exe
-
Size
9.5MB
-
Sample
240905-agj33azfmg
-
MD5
3d50042e3e3991be509f56a2951a2183
-
SHA1
f027790afe9d7ce2ddf17973f0778fb9e983ded1
-
SHA256
76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2
-
SHA512
120c6a7778bd9f65f469d3335987b780e736bd895ed944d0988372f891b48f9ba09b50ed9dcffd0bf1fa23a12e215ed1f1ffe75d11c925ff4c08d3e48259a873
-
SSDEEP
196608:xoEToOU9+86NdnrqNnHmQ3bKfIiaNPFHNRsiK:xLTtU/QxrqNHL3bIIiEHMn
Static task
static1
Behavioral task
behavioral1
Sample
Delta V3.61 b_49450291.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
Delta V3.61 b_49450291.exe
-
Size
9.5MB
-
MD5
3d50042e3e3991be509f56a2951a2183
-
SHA1
f027790afe9d7ce2ddf17973f0778fb9e983ded1
-
SHA256
76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2
-
SHA512
120c6a7778bd9f65f469d3335987b780e736bd895ed944d0988372f891b48f9ba09b50ed9dcffd0bf1fa23a12e215ed1f1ffe75d11c925ff4c08d3e48259a873
-
SSDEEP
196608:xoEToOU9+86NdnrqNnHmQ3bKfIiaNPFHNRsiK:xLTtU/QxrqNHL3bIIiEHMn
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks for any installed AV software in registry
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Image File Execution Options Injection
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
5Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5Software Discovery
1Security Software Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1