Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd

  • Size

    2.9MB

  • Sample

    250112-hcnvfs1kbv

  • MD5

    8221efe81c93c9b232d597add4e11d61

  • SHA1

    46b631a99272293f029f41323959ab29d1317b76

  • SHA256

    c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd

  • SHA512

    ea3dea30a683c3ba669c3a4dceaede8229781ad84cebc254205ecc21469a2b0defd9be8a769debd05ca04bdb39955e5b3d01cfc81c98a37e22ccd4b6d0e409c4

  • SSDEEP

    24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHG:ATU7AAmw4gxeOw46fUbNecCCFbNec9

Malware Config

Targets

    • Target

      c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd

    • Size

      2.9MB

    • MD5

      8221efe81c93c9b232d597add4e11d61

    • SHA1

      46b631a99272293f029f41323959ab29d1317b76

    • SHA256

      c2f06720f24ed75ed801a027453900623f1f8829438562bf7564f1fe92f6bbcd

    • SHA512

      ea3dea30a683c3ba669c3a4dceaede8229781ad84cebc254205ecc21469a2b0defd9be8a769debd05ca04bdb39955e5b3d01cfc81c98a37e22ccd4b6d0e409c4

    • SSDEEP

      24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHG:ATU7AAmw4gxeOw46fUbNecCCFbNec9

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzonerat family

    • Warzone RAT payload

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks