Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565N
-
Size
3.9MB
-
Sample
240918-2phnraxbkb
-
MD5
b81e3be278c8262e7fbf6a50d788a210
-
SHA1
5543156592154a6253e16c73e7bfbf850696a93e
-
SHA256
b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565
-
SHA512
7b382850ed2d4b9c690f6ef884db732ed52e809da7427176050b0eed20a94edbacf30be9f2bc86b3718f98148238ee2998d2a2b5558532815ac2e5700aacb0cc
-
SSDEEP
24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDF:7C0bNechC0bNechC0bNecN
Behavioral task
behavioral1
Sample
b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565N.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565N
-
Size
3.9MB
-
MD5
b81e3be278c8262e7fbf6a50d788a210
-
SHA1
5543156592154a6253e16c73e7bfbf850696a93e
-
SHA256
b64c3cd0b770af1fa95ebfa2cce84cfc2252a939f098735027e66db667f69565
-
SHA512
7b382850ed2d4b9c690f6ef884db732ed52e809da7427176050b0eed20a94edbacf30be9f2bc86b3718f98148238ee2998d2a2b5558532815ac2e5700aacb0cc
-
SSDEEP
24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDF:7C0bNechC0bNechC0bNecN
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4