Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3023c6c4730f42f68856fc8558af778d078cf163935209f96de798ca72a1bb70.exe
-
Size
120KB
-
Sample
241222-snc77ssmdn
-
MD5
b058c37d8c1cf21985e70ac22116f4ca
-
SHA1
c3ab7dc79c52e2a425981981f60f20d14f90480b
-
SHA256
3023c6c4730f42f68856fc8558af778d078cf163935209f96de798ca72a1bb70
-
SHA512
6147d0f797b380bb1fbd94311fd155276db728a0e7dc4164c0ccb8259a0d5697b1d70b6821ab6bdeaabdcd6e7bc6aa84e78327b925fc06ede1d21f99b36edcc1
-
SSDEEP
1536:zW33nb2aQNX9T0QQwVz1AxNaRAW13spw8wCcDhr67MXmB8T2p:zWnnblEtptVKRW1spw8x6h2T82p
Static task
static1
Behavioral task
behavioral1
Sample
3023c6c4730f42f68856fc8558af778d078cf163935209f96de798ca72a1bb70.dll
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
3023c6c4730f42f68856fc8558af778d078cf163935209f96de798ca72a1bb70.exe
-
Size
120KB
-
MD5
b058c37d8c1cf21985e70ac22116f4ca
-
SHA1
c3ab7dc79c52e2a425981981f60f20d14f90480b
-
SHA256
3023c6c4730f42f68856fc8558af778d078cf163935209f96de798ca72a1bb70
-
SHA512
6147d0f797b380bb1fbd94311fd155276db728a0e7dc4164c0ccb8259a0d5697b1d70b6821ab6bdeaabdcd6e7bc6aa84e78327b925fc06ede1d21f99b36edcc1
-
SSDEEP
1536:zW33nb2aQNX9T0QQwVz1AxNaRAW13spw8wCcDhr67MXmB8T2p:zWnnblEtptVKRW1spw8x6h2T82p
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5