Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Bootstrapper.exe

  • Size

    81.0MB

  • Sample

    241202-2wb5jsxkey

  • MD5

    8e4459028b7b17ef356a8be2ad50c8ed

  • SHA1

    084c9494f68755bc64e0fceb97834af2ccfec5d6

  • SHA256

    f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6

  • SHA512

    fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad

  • SSDEEP

    1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW

Malware Config

Targets

    • Target

      Bootstrapper.exe

    • Size

      81.0MB

    • MD5

      8e4459028b7b17ef356a8be2ad50c8ed

    • SHA1

      084c9494f68755bc64e0fceb97834af2ccfec5d6

    • SHA256

      f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6

    • SHA512

      fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad

    • SSDEEP

      1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.