Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

URLScan

urlscan

1

http://itch.io

windows11-21h2-x64

9

Resubmissions

08/02/2025, 16:34

250208-t3cqnavngw 8

08/02/2025, 16:34

250208-t229xsvnfy 3

08/02/2025, 16:33

250208-t2qacsvnft 8

06/02/2025, 15:35

250206-s1njpsypez 4

05/02/2025, 16:40

250205-t62tysvlfv 10

27/01/2025, 09:56

250127-lym2tssqf1 3

19/12/2024, 16:24

241219-twqc6swkfr 9

04/12/2024, 21:04

241204-zwlb4sxjdr 7

30/11/2024, 20:46

241130-zkncbsyphl 3

10/11/2024, 21:18

241110-z5t1lsylfk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://itch.io

  • Sample

    241219-twqc6swkfr

Score
9/10
bootkitdefense_evasiondiscoveryevasionpersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target

      http://itch.io

    Score
    9/10
    bootkitdefense_evasiondiscoveryevasionpersistenceprivilege_escalationransomware

    • Renames multiple (98) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks