Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565N

  • Size

    3.9MB

  • Sample

    240918-2phnraxbkb

  • MD5

    b81e3be278c8262e7fbf6a50d788a210

  • SHA1

    5543156592154a6253e16c73e7bfbf850696a93e

  • SHA256

    b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565

  • SHA512

    7b382850ed2d4b9c690f6ef884db732ed52e809da7427176050b0eed20a94edbacf30be9f2bc86b3718f98148238ee2998d2a2b5558532815ac2e5700aacb0cc

  • SSDEEP

    24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDF:7C0bNechC0bNechC0bNecN

Malware Config

Targets

    • Target

      b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565N

    • Size

      3.9MB

    • MD5

      b81e3be278c8262e7fbf6a50d788a210

    • SHA1

      5543156592154a6253e16c73e7bfbf850696a93e

    • SHA256

      b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565

    • SHA512

      7b382850ed2d4b9c690f6ef884db732ed52e809da7427176050b0eed20a94edbacf30be9f2bc86b3718f98148238ee2998d2a2b5558532815ac2e5700aacb0cc

    • SSDEEP

      24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDF:7C0bNechC0bNechC0bNecN

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks