Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72
-
Size
2.6MB
-
Sample
250115-177j6aymfm
-
MD5
4dedefe4431f91c920d9aaaceb99e2ee
-
SHA1
9a20559fa8a3e670c734837de16fa508d5e25b41
-
SHA256
81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72
-
SHA512
cb7d2fe42cd44f7b1c31102961c579d7ba5a6e8f5071dfdb372dade85f56572dd870f54ca32b160faa58536f0f40e4ceb39745ae076fb8d546dd358ebe96f086
-
SSDEEP
49152:wgwReifu1DBgutBPN4gJEkSBz4aPUAigHrBYlHYw/s5CH5Ie71yAmiESeJKeqy:wgwRevguPPjg946UAFLBEYw/s5CX7tmj
Static task
static1
Behavioral task
behavioral1
Sample
81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72
-
Size
2.6MB
-
MD5
4dedefe4431f91c920d9aaaceb99e2ee
-
SHA1
9a20559fa8a3e670c734837de16fa508d5e25b41
-
SHA256
81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72
-
SHA512
cb7d2fe42cd44f7b1c31102961c579d7ba5a6e8f5071dfdb372dade85f56572dd870f54ca32b160faa58536f0f40e4ceb39745ae076fb8d546dd358ebe96f086
-
SSDEEP
49152:wgwReifu1DBgutBPN4gJEkSBz4aPUAigHrBYlHYw/s5CH5Ie71yAmiESeJKeqy:wgwRevguPPjg946UAFLBEYw/s5CX7tmj
-
Detects Mimic ransomware
-
Mimic family
-
Modifies security service
-
Modifies boot configuration data using bcdedit
-
Renames multiple (6327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1File Deletion
1Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1