Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7fdd6a81a4ef7bd5a4c04351d3e0149ad830bb1168f93101d4c95d4378778332.exe
-
Size
1.8MB
-
Sample
240930-twcr3syeme
-
MD5
f459a1531f07ce212119cf022161b60b
-
SHA1
60c19230829b1fc4b6dee0fc90172417b3fb864a
-
SHA256
7fdd6a81a4ef7bd5a4c04351d3e0149ad830bb1168f93101d4c95d4378778332
-
SHA512
b6ebb2ab4f6cc2ba14bd71c0b5e4508fc93cc951520d40655128e43684637a72dc7a77637b7929a6d59043c18e027ae7da73f2285ef8e8e588cd9956491edc98
-
SSDEEP
24576:4hvO86HNJck3aKoH5xFBl006Wq59hT6/qinUVEXa+YqxRbw4mMNtJl5E+29wjqqT:EUmPWNF5f6OXoxWINthjmq
Static task
static1
Behavioral task
behavioral1
Sample
7fdd6a81a4ef7bd5a4c04351d3e0149ad830bb1168f93101d4c95d4378778332.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7fdd6a81a4ef7bd5a4c04351d3e0149ad830bb1168f93101d4c95d4378778332.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
7fdd6a81a4ef7bd5a4c04351d3e0149ad830bb1168f93101d4c95d4378778332.exe
-
Size
1.8MB
-
MD5
f459a1531f07ce212119cf022161b60b
-
SHA1
60c19230829b1fc4b6dee0fc90172417b3fb864a
-
SHA256
7fdd6a81a4ef7bd5a4c04351d3e0149ad830bb1168f93101d4c95d4378778332
-
SHA512
b6ebb2ab4f6cc2ba14bd71c0b5e4508fc93cc951520d40655128e43684637a72dc7a77637b7929a6d59043c18e027ae7da73f2285ef8e8e588cd9956491edc98
-
SSDEEP
24576:4hvO86HNJck3aKoH5xFBl006Wq59hT6/qinUVEXa+YqxRbw4mMNtJl5E+29wjqqT:EUmPWNF5f6OXoxWINthjmq
Score10/10-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1