Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
source_prepared.zip
-
Size
81.2MB
-
Sample
240913-vc8abayalc
-
MD5
10ecec64ec39e030b9c8dca17c589e16
-
SHA1
620317eccba3ec20ea5ad134930c331aec6f9527
-
SHA256
c43ba4674688b696d37be0123102595ead8335af525477bbbedfce9ee55a9475
-
SHA512
82469457af35e58db68cde28852053359e8731a2a8272a240b909982b43cca2131776c0f502a7b790c05ab54f0d83e75e26566b167b3f6823225229cd21bae95
-
SSDEEP
1572864:GXZh49YdDAn6ObGWZglOhpArAXb9tjG/bgBIRH8scNrYNjjapxe1/atD47YrRWU:G3oYJS6VWGLrAXb9Zx7MNuc1UyURWU
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20240910-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
81.6MB
-
MD5
2d50c1e5ee7eb5a888c4f68f00abc07e
-
SHA1
8980eb85bf3501d5890e518cb2cb6d1c83f884ad
-
SHA256
eda5eddfb47860b05356bbf716833d6f436293784f8f2bdd5d369f5b6ea89f43
-
SHA512
e3a17ed04c1c527ec881bcd1e0e885ea82b5779c8a740d6e233ba2d64897a4ca1bef7efb35545b7d123b388cf4d93bf5568cadf193d0494af8ba2d34fe20f95f
-
SSDEEP
1572864:jvxZQglXedWFZSk8IpG7V+VPhqb+T9E7Ulg8iYgj+h58sMw5ID93AVqDNX:jvxZxRQyZSkB05awb+TJe25Fu93L
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1