Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
18/01/2025, 18:30
250118-w5xvqa1qdk 818/01/2025, 18:01
250118-wmdn5azlcs 818/01/2025, 17:59
250118-wk5pts1lbr 1018/01/2025, 15:49
250118-s9gshsykar 1018/01/2025, 15:28
250118-swm3daxqbn 818/01/2025, 15:20
250118-sq4g6swpet 818/01/2025, 15:17
250118-spg8jsxnhn 818/01/2025, 15:15
250118-smwcdsxnek 718/01/2025, 15:12
250118-slc5esxnbp 1018/01/2025, 15:09
250118-sjqyhaxmgr 7General
-
Target
Знімок екрана 2025-01-17 164150.png
-
Size
89KB
-
Sample
250118-swm3daxqbn
-
MD5
bc6ca19d49bf9037ac632b050e2c7b36
-
SHA1
3505656078d7dab8cb4e8a0987113d7d146d9cde
-
SHA256
fc5bca3c384922d0d27ba63e56e22c4463206cbbf90ee50a115e644278837420
-
SHA512
9ab597c0d067c7ce438ab8e0d7d554124612b85a4e66640e979677866f9dfde48489c33120e75ec902fc6bc85b3616cbd53bf6e9d03457ebc1f4d20e25cd9f4d
-
SSDEEP
1536:zgmr9TL/IDgOTLEU3uaMSnu2YsA3DNq3EcUfeEoCTWoOkS00zsRh3XY3/+hAOAf:8mr9TCTxrANot6eEzq7kS0dXY3sAf
Static task
static1
Malware Config
Targets
-
-
Target
Знімок екрана 2025-01-17 164150.png
-
Size
89KB
-
MD5
bc6ca19d49bf9037ac632b050e2c7b36
-
SHA1
3505656078d7dab8cb4e8a0987113d7d146d9cde
-
SHA256
fc5bca3c384922d0d27ba63e56e22c4463206cbbf90ee50a115e644278837420
-
SHA512
9ab597c0d067c7ce438ab8e0d7d554124612b85a4e66640e979677866f9dfde48489c33120e75ec902fc6bc85b3616cbd53bf6e9d03457ebc1f4d20e25cd9f4d
-
SSDEEP
1536:zgmr9TL/IDgOTLEU3uaMSnu2YsA3DNq3EcUfeEoCTWoOkS00zsRh3XY3/+hAOAf:8mr9TCTxrANot6eEzq7kS0dXY3sAf
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts a large (517) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1