Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Bootstrapper.exe
-
Size
796KB
-
Sample
240908-xx8gxstgkh
-
MD5
5f16b82a8b62d4cc9d6ce02f44e34109
-
SHA1
be96254773cba2c6f0b88e51319802b1c6394beb
-
SHA256
1621a516abb8ecf9459c9dec83f7fb9beb07af1f79511dfe0b3c622297ffa940
-
SHA512
956d983c7f076b176bfd1952e691e2d363c332dba317645ce991c9bb2f4ddd89771f0d035cbb70ab420b9dd906b3a6d0aecc6c8243ba6a4ac70979cebb00986b
-
SSDEEP
3072:nTaFZMwaCyYwC+M2FEv80IZOA/CyYwC+M2FEv80IZOAu80IZOA4:lhY7X2Kvh4hY7X2Kvhlh
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
Bootstrapper.exe
-
Size
796KB
-
MD5
5f16b82a8b62d4cc9d6ce02f44e34109
-
SHA1
be96254773cba2c6f0b88e51319802b1c6394beb
-
SHA256
1621a516abb8ecf9459c9dec83f7fb9beb07af1f79511dfe0b3c622297ffa940
-
SHA512
956d983c7f076b176bfd1952e691e2d363c332dba317645ce991c9bb2f4ddd89771f0d035cbb70ab420b9dd906b3a6d0aecc6c8243ba6a4ac70979cebb00986b
-
SSDEEP
3072:nTaFZMwaCyYwC+M2FEv80IZOA/CyYwC+M2FEv80IZOAu80IZOA4:lhY7X2Kvh4hY7X2Kvhlh
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1