Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195
-
Size
1.7MB
-
Sample
241012-x36waaxcqb
-
MD5
ce281d3cea993ab4c7a151308a215b99
-
SHA1
f2bc0362a45665ea5f7eaae0305a65a9dc412539
-
SHA256
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195
-
SHA512
6b535c2355d9d11aca6d74d5d02fea0638668a9e51aca3ca38480bd0719f9a7f84ddda49f767816242d966948d898d1d90ad9efe45a3236f009e9eb7b3ca7b24
-
SSDEEP
24576:89SQXgnU56Gt4ULYVI8RGwvrK7/ckFLI78cP9:ssnxUA
Behavioral task
behavioral1
Sample
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195
-
Size
1.7MB
-
MD5
ce281d3cea993ab4c7a151308a215b99
-
SHA1
f2bc0362a45665ea5f7eaae0305a65a9dc412539
-
SHA256
1ac7b11f2970f58550848929c1a9899132f5914e0922325a277572318c2ce195
-
SHA512
6b535c2355d9d11aca6d74d5d02fea0638668a9e51aca3ca38480bd0719f9a7f84ddda49f767816242d966948d898d1d90ad9efe45a3236f009e9eb7b3ca7b24
-
SSDEEP
24576:89SQXgnU56Gt4ULYVI8RGwvrK7/ckFLI78cP9:ssnxUA
Score10/10-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
7