Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
https://github.com/cchm123456999/malware_sha1_hashes
-
Sample
250310-zen2nsx1bw
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/cchm123456999/malware_sha1_hashes
Resource
win11-20250217-en
Malware Config
Targets
-
-
Target
https://github.com/cchm123456999/malware_sha1_hashes
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Badrabbit family
-
Modifies Windows Defender Real-time Protection settings
-
Rms family
-
UAC bypass
-
Windows security bypass
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Hide Artifacts: Hidden Users
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
1Hidden Users
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Subvert Trust Controls
1SIP and Trust Provider Hijacking
1