Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Bootstrapper.exe
-
Size
796KB
-
Sample
240908-ytdntawame
-
MD5
5f16b82a8b62d4cc9d6ce02f44e34109
-
SHA1
be96254773cba2c6f0b88e51319802b1c6394beb
-
SHA256
1621a516abb8ecf9459c9dec83f7fb9beb07af1f79511dfe0b3c622297ffa940
-
SHA512
956d983c7f076b176bfd1952e691e2d363c332dba317645ce991c9bb2f4ddd89771f0d035cbb70ab420b9dd906b3a6d0aecc6c8243ba6a4ac70979cebb00986b
-
SSDEEP
3072:nTaFZMwaCyYwC+M2FEv80IZOA/CyYwC+M2FEv80IZOAu80IZOA4:lhY7X2Kvh4hY7X2Kvhlh
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lumma
https://tenntysjuxmz.shop/api
Targets
-
-
Target
Bootstrapper.exe
-
Size
796KB
-
MD5
5f16b82a8b62d4cc9d6ce02f44e34109
-
SHA1
be96254773cba2c6f0b88e51319802b1c6394beb
-
SHA256
1621a516abb8ecf9459c9dec83f7fb9beb07af1f79511dfe0b3c622297ffa940
-
SHA512
956d983c7f076b176bfd1952e691e2d363c332dba317645ce991c9bb2f4ddd89771f0d035cbb70ab420b9dd906b3a6d0aecc6c8243ba6a4ac70979cebb00986b
-
SSDEEP
3072:nTaFZMwaCyYwC+M2FEv80IZOA/CyYwC+M2FEv80IZOAu80IZOA4:lhY7X2Kvh4hY7X2Kvhlh
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Enumerates processes with tasklist
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1