Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    sample

  • Size

    20KB

  • Sample

    241013-l1pnfa1alb

  • MD5

    c19fdc2b48dfecf25b36933617709df2

  • SHA1

    206f9cdf5f5fc7c2d20a2134fad614c40cb7044d

  • SHA256

    56ac2bb0bea575eb85089eb2ab8059408d16100a46b5fe5aafb7eb14440cfb22

  • SHA512

    369ab844257f1e4d6b014c7458c61c174c7215ccf420526b812c23146e1d2f1a7a7841f915bd33d84378dc57e1fb943663a5b36feb45766dfd28e1930e6de3d2

  • SSDEEP

    384:B3hK4spa1ocy4d4lbGajMvhpNJe34gro2REu4Y0wM1Okfg1xCejiw:p1ocy4OEaAJpNg3prEu4Y0wM1BqxPiw

Malware Config

Targets

    • Target

      sample

    • Size

      20KB

    • MD5

      c19fdc2b48dfecf25b36933617709df2

    • SHA1

      206f9cdf5f5fc7c2d20a2134fad614c40cb7044d

    • SHA256

      56ac2bb0bea575eb85089eb2ab8059408d16100a46b5fe5aafb7eb14440cfb22

    • SHA512

      369ab844257f1e4d6b014c7458c61c174c7215ccf420526b812c23146e1d2f1a7a7841f915bd33d84378dc57e1fb943663a5b36feb45766dfd28e1930e6de3d2

    • SSDEEP

      384:B3hK4spa1ocy4d4lbGajMvhpNJe34gro2REu4Y0wM1Okfg1xCejiw:p1ocy4OEaAJpNg3prEu4Y0wM1BqxPiw

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks