Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b20b6f845862d1c96a1516081a20b9ec6f6a0a3ce3f2e94c5ef9f1f27e91735eN
-
Size
487KB
-
Sample
241021-c2wzgatgqg
-
MD5
e6fabd7fba7e527f0e798b3088ca0ad0
-
SHA1
9160bcb5caceaddd612305e6ba50c342d745015e
-
SHA256
b20b6f845862d1c96a1516081a20b9ec6f6a0a3ce3f2e94c5ef9f1f27e91735e
-
SHA512
7481d2a3e171e58daca9292c0896596f060e216330f4f0fe8810628942e64c6125ca085f42ecb975aff667da2a70b54fa42aed1e2baa06359d9d451577d43200
-
SSDEEP
12288:jNEyVG84YXVG84Y9VG84YDVG84YXVG84Yi:jN1VG8BVG8zVG89VG8BVG8c
Static task
static1
Behavioral task
behavioral1
Sample
b20b6f845862d1c96a1516081a20b9ec6f6a0a3ce3f2e94c5ef9f1f27e91735eN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b20b6f845862d1c96a1516081a20b9ec6f6a0a3ce3f2e94c5ef9f1f27e91735eN.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
b20b6f845862d1c96a1516081a20b9ec6f6a0a3ce3f2e94c5ef9f1f27e91735eN
-
Size
487KB
-
MD5
e6fabd7fba7e527f0e798b3088ca0ad0
-
SHA1
9160bcb5caceaddd612305e6ba50c342d745015e
-
SHA256
b20b6f845862d1c96a1516081a20b9ec6f6a0a3ce3f2e94c5ef9f1f27e91735e
-
SHA512
7481d2a3e171e58daca9292c0896596f060e216330f4f0fe8810628942e64c6125ca085f42ecb975aff667da2a70b54fa42aed1e2baa06359d9d451577d43200
-
SSDEEP
12288:jNEyVG84YXVG84Y9VG84YDVG84YXVG84Yi:jN1VG8BVG8zVG89VG8BVG8c
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Disables RegEdit via registry modification
-
Disables use of System Restore points
-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
8