Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a797b8d85a1a3654cf2578b3025e2d265fd9c45ecfea95d7b9c2a08eaa0d9a43N

  • Size

    20KB

  • Sample

    240930-xyp2za1cpp

  • MD5

    8fce0865c8cce17a58b7afe940d30380

  • SHA1

    56e081a51ae2690f2280eabcf6a4b1008261203c

  • SHA256

    a797b8d85a1a3654cf2578b3025e2d265fd9c45ecfea95d7b9c2a08eaa0d9a43

  • SHA512

    3f7834ae93dd9e7b68c1b1a9e2e5e02a07169f54072b441200da42d52518413349a1169a00d5a06ffaf460b5f0081cc88ce6eb421d2e9550a034e85230f52c7f

  • SSDEEP

    384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXziCybr:rRkiLw3HsDSARGG/jfer

Malware Config

Targets

    • Target

      a797b8d85a1a3654cf2578b3025e2d265fd9c45ecfea95d7b9c2a08eaa0d9a43N

    • Size

      20KB

    • MD5

      8fce0865c8cce17a58b7afe940d30380

    • SHA1

      56e081a51ae2690f2280eabcf6a4b1008261203c

    • SHA256

      a797b8d85a1a3654cf2578b3025e2d265fd9c45ecfea95d7b9c2a08eaa0d9a43

    • SHA512

      3f7834ae93dd9e7b68c1b1a9e2e5e02a07169f54072b441200da42d52518413349a1169a00d5a06ffaf460b5f0081cc88ce6eb421d2e9550a034e85230f52c7f

    • SSDEEP

      384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXziCybr:rRkiLw3HsDSARGG/jfer

    • Windows security bypass

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Indicator Removal: Clear Persistence

      remove IFEO.

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks