Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Application.zip

  • Size

    349KB

  • Sample

    250219-cpejnavkbk

  • MD5

    cb3837512dabf289278b7310c27a2661

  • SHA1

    496f07dfccc038d7090f6ecc273f0505b2b102bf

  • SHA256

    dd6289a8652b5e83a3216ed8e6c0c37afab48409c1f5d76269341d83223441a2

  • SHA512

    1866c8bbeaafaee1582a2ad48da2dce4820753355d0b2b24a1d4eb8bee35139b95e569ddf94c62329bcdde52672c034060628887931583f358ace2a94fdd2b68

  • SSDEEP

    6144:TuUPsgJV8ZHLO2Y1RZbDGFIPMKseQnJ16DXbfEnmZ3GtIp/S+as9HYjs9431BCbC:S+38ZpY1PDGmPWerrEnm1rpEW2so1cbC

Malware Config

Targets

    • Target

      Application.zip

    • Size

      349KB

    • MD5

      cb3837512dabf289278b7310c27a2661

    • SHA1

      496f07dfccc038d7090f6ecc273f0505b2b102bf

    • SHA256

      dd6289a8652b5e83a3216ed8e6c0c37afab48409c1f5d76269341d83223441a2

    • SHA512

      1866c8bbeaafaee1582a2ad48da2dce4820753355d0b2b24a1d4eb8bee35139b95e569ddf94c62329bcdde52672c034060628887931583f358ace2a94fdd2b68

    • SSDEEP

      6144:TuUPsgJV8ZHLO2Y1RZbDGFIPMKseQnJ16DXbfEnmZ3GtIp/S+as9HYjs9431BCbC:S+38ZpY1PDGmPWerrEnm1rpEW2so1cbC

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Network Share Discovery

      Attempt to gather information on host network.

    • Detected potential entity reuse from brand GOOGLE.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks