Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

08112024_1...81.msi

windows7-x64

6

08112024_1...81.msi

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08112024_1447_BluetraitAgent381.msi

  • Size

    3.6MB

  • Sample

    241108-r6apcswqcr

  • MD5

    0c7d30468c0d5975866b6f10017330d9

  • SHA1

    0f2d7d1d9fa10d46e8d73c75db7509f950578bc6

  • SHA256

    1cd8f56f9213249e555dedda4380add02cbe74fb81a5806ef1eec3935a7f041a

  • SHA512

    6b42376e6c0b69eb5e005a64c1cf6e92a27938ede43badf599c496a508c7d10e5178109e899de79d4aa01b15d982c748f3e5ece657815916f68dcd3fdb2dfd5e

  • SSDEEP

    98304:7JAqhv+JtUaJRWta/Tbs9JVzlgroDWX9Ha:7Jzhv+MaR/c93BW2S9

Score
6/10
discoveryevasionexecutionlateral_movementpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      08112024_1447_BluetraitAgent381.msi

    • Size

      3.6MB

    • MD5

      0c7d30468c0d5975866b6f10017330d9

    • SHA1

      0f2d7d1d9fa10d46e8d73c75db7509f950578bc6

    • SHA256

      1cd8f56f9213249e555dedda4380add02cbe74fb81a5806ef1eec3935a7f041a

    • SHA512

      6b42376e6c0b69eb5e005a64c1cf6e92a27938ede43badf599c496a508c7d10e5178109e899de79d4aa01b15d982c748f3e5ece657815916f68dcd3fdb2dfd5e

    • SSDEEP

      98304:7JAqhv+JtUaJRWta/Tbs9JVzlgroDWX9Ha:7Jzhv+MaR/c93BW2S9

    Score
    6/10
    discoverypersistenceprivilege_escalationevasionexecutionlateral_movementtrojan

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies Windows Firewall

      evasion

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

      discovery

    • Remote Services: SMB/Windows Admin Shares

      Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

      lateral_movement

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Installer Packages

1
T1546.016

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Installer Packages

1
T1546.016

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Password Policy Discovery

1
T1201

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Remote Services

1
T1021

SMB/Windows Admin Shares

1
T1021.002

Collection

Command and Control

Exfiltration

Impact

Tasks