Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    258ea6808e26a5af1d34438db50d295eaf6a470555b40531033b9317ba7a5873N.exe

  • Size

    2.5MB

  • Sample

    250125-ddtd4stldq

  • MD5

    3295c39ad0797978ee732a27ed981930

  • SHA1

    8a6b4f5a6f66cb4a024b8d35e0b42d2d0b0f3bd0

  • SHA256

    258ea6808e26a5af1d34438db50d295eaf6a470555b40531033b9317ba7a5873

  • SHA512

    489b6875da74b84e7f49240346102056de33a21e21c9f9ea3f18c93ab981a9aa9d06a42c2d618c4e81043dcb43b61d3b315def69c516844196344c486f8a44f3

  • SSDEEP

    49152:WYvvXwqFNL1ZcXoNgOPvUkbv+2Tp85swGSwVboj6vop1QDCz1IscebA5rOYiZnG:WWvX3FZ1q4XHhbWgpuPj6Ap1Q417cebY

Malware Config

Targets

    • Target

      258ea6808e26a5af1d34438db50d295eaf6a470555b40531033b9317ba7a5873N.exe

    • Size

      2.5MB

    • MD5

      3295c39ad0797978ee732a27ed981930

    • SHA1

      8a6b4f5a6f66cb4a024b8d35e0b42d2d0b0f3bd0

    • SHA256

      258ea6808e26a5af1d34438db50d295eaf6a470555b40531033b9317ba7a5873

    • SHA512

      489b6875da74b84e7f49240346102056de33a21e21c9f9ea3f18c93ab981a9aa9d06a42c2d618c4e81043dcb43b61d3b315def69c516844196344c486f8a44f3

    • SSDEEP

      49152:WYvvXwqFNL1ZcXoNgOPvUkbv+2Tp85swGSwVboj6vop1QDCz1IscebA5rOYiZnG:WWvX3FZ1q4XHhbWgpuPj6Ap1Q417cebY

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Enterprise v15

Tasks