Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    gatherNetworkInfo.vbs

  • Size

    86KB

  • Sample

    241003-bsmtrs1cqd

  • MD5

    2e6af4d5bf6e31e728f409984c3045d4

  • SHA1

    757bf5310f40a69d883f11e75f220e02fbaa0127

  • SHA256

    d906d6126a1e9c9569ef81605d02f03ef94aa57b3ab9cbd56c996baf22fa461b

  • SHA512

    2ff376bee712a61cb4a6ff8f0f3ac0ac9778acdaf0cb767d9d085502cb8e9365458292266e994a3d973494759b43181511aaf050ec0d48bfa7e51b07a3b56bfa

  • SSDEEP

    1536:sImNGeeGUJIgZf/A+qfwkgKo9kNxyJ3OOjPl68fef0qIbIE5ToGdKTYL7TBHQ/8S:sImNGXGUJtx/A+qfol6yqZs8J

Malware Config

Targets

    • Target

      gatherNetworkInfo.vbs

    • Size

      86KB

    • MD5

      2e6af4d5bf6e31e728f409984c3045d4

    • SHA1

      757bf5310f40a69d883f11e75f220e02fbaa0127

    • SHA256

      d906d6126a1e9c9569ef81605d02f03ef94aa57b3ab9cbd56c996baf22fa461b

    • SHA512

      2ff376bee712a61cb4a6ff8f0f3ac0ac9778acdaf0cb767d9d085502cb8e9365458292266e994a3d973494759b43181511aaf050ec0d48bfa7e51b07a3b56bfa

    • SSDEEP

      1536:sImNGeeGUJIgZf/A+qfwkgKo9kNxyJ3OOjPl68fef0qIbIE5ToGdKTYL7TBHQ/8S:sImNGXGUJtx/A+qfol6yqZs8J

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks