Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
pepe.jpg
-
Size
9KB
-
Sample
250101-xvtwrayphx
-
MD5
75494425adf92da992dc799a556f65ea
-
SHA1
03a82524d97f766d2cd7305e45566e560197a512
-
SHA256
463a64d183f90599991de74c1b48330ad796fcd7aa733ac1a9be131eaa80618c
-
SHA512
20ddaec720ba304b644a010bfb3676fe13f64d9e7099e333051e5db43e2563d983fab29565e5f7902b017217ff450f5ce9ad68f2fa155ec780bbdd2914a117f7
-
SSDEEP
192:PT5eLK+PqoNaK7HrML4vT4ZkGorW+1ewk108rCqbWOqQlW:PlCBbw2xrWkb8rCqKqW
Static task
static1
Behavioral task
behavioral1
Sample
pepe.jpg
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
pepe.jpg
-
Size
9KB
-
MD5
75494425adf92da992dc799a556f65ea
-
SHA1
03a82524d97f766d2cd7305e45566e560197a512
-
SHA256
463a64d183f90599991de74c1b48330ad796fcd7aa733ac1a9be131eaa80618c
-
SHA512
20ddaec720ba304b644a010bfb3676fe13f64d9e7099e333051e5db43e2563d983fab29565e5f7902b017217ff450f5ce9ad68f2fa155ec780bbdd2914a117f7
-
SSDEEP
192:PT5eLK+PqoNaK7HrML4vT4ZkGorW+1ewk108rCqbWOqQlW:PlCBbw2xrWkb8rCqKqW
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
A potential corporate email address has been identified in the URL: businessdonate@yourwaresolutions.comitemnameYourWareSolutionsContributionnoshipping1returnhttp
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3