Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

download.png

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    download.png

  • Size

    2KB

  • Sample

    241001-xlcacayfld

  • MD5

    c1a0892088d55517ca579dd597de66f9

  • SHA1

    465f3c4b77b1d2fb0fc8443ea44992db839eca01

  • SHA256

    f356c1e5e8ec22a79b2547dd939d824d40200e5c599b38c7d7b531f6b2778f51

  • SHA512

    db7ad5a8ad60a2505faf056673e27c3bec3034d245f874b22eee678b279b79561df8f1c7739663836e298469ffd99589e098abbba484738e217155afe0132cdb

Score
10/10
discoveryevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      download.png

    • Size

      2KB

    • MD5

      c1a0892088d55517ca579dd597de66f9

    • SHA1

      465f3c4b77b1d2fb0fc8443ea44992db839eca01

    • SHA256

      f356c1e5e8ec22a79b2547dd939d824d40200e5c599b38c7d7b531f6b2778f51

    • SHA512

      db7ad5a8ad60a2505faf056673e27c3bec3034d245f874b22eee678b279b79561df8f1c7739663836e298469ffd99589e098abbba484738e217155afe0132cdb

    Score
    10/10
    discoveryevasionpersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Tasks