Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

Chorme_ins...03.msi

windows7-x64

6

Chorme_ins...03.msi

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Chorme_installer_v56.58.03.msi.v

  • Size

    37.2MB

  • Sample

    241003-gl7s9axgqj

  • MD5

    2e859514e7c8e73b276d5f0cbe5a7cca

  • SHA1

    2d46ba837702a6f11bed1a6298b7fd443feb8c63

  • SHA256

    9c9aca6b60e90876f4c2727ecfb5ec5021586f830dee3da064f9d99605410d15

  • SHA512

    5a00b43861009cf82708167b263965cad7a327bbcb2bd01c3c1bcc1e6793ef75aa5fe8035a54e9f502cac5b7aa3a92b251d53481eff15b04870a3d07aa27d257

  • SSDEEP

    786432:Pib1xBH1OwK5d+coZlrR0GiuskPuJJNJUON8y+cv+1dnnZZ8bbiqbBP0:Kb1X1O/d+co3ODJNJV8fcva9nZZmi6

Score
6/10
discoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target

      Chorme_installer_v56.58.03.msi.v

    • Size

      37.2MB

    • MD5

      2e859514e7c8e73b276d5f0cbe5a7cca

    • SHA1

      2d46ba837702a6f11bed1a6298b7fd443feb8c63

    • SHA256

      9c9aca6b60e90876f4c2727ecfb5ec5021586f830dee3da064f9d99605410d15

    • SHA512

      5a00b43861009cf82708167b263965cad7a327bbcb2bd01c3c1bcc1e6793ef75aa5fe8035a54e9f502cac5b7aa3a92b251d53481eff15b04870a3d07aa27d257

    • SSDEEP

      786432:Pib1xBH1OwK5d+coZlrR0GiuskPuJJNJUON8y+cv+1dnnZZ8bbiqbBP0:Kb1X1O/d+co3ODJNJV8fcva9nZZmi6

    Score
    6/10
    discoverypersistenceprivilege_escalationevasionspywarestealertrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Defense Evasion

Modify Registry

1
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.