Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    240751d8c98257456ef6583c41d96e88c5c66ef699d35ab93f346ee889a6c981

  • Size

    634KB

  • Sample

    221002-yeanlsgad7

  • MD5

    4e476f99ee7e271e734179b3683afcb0

  • SHA1

    1a0e3b22b8466ca2475287558b94c5c6ec59d85c

  • SHA256

    240751d8c98257456ef6583c41d96e88c5c66ef699d35ab93f346ee889a6c981

  • SHA512

    ecf5cd557727768b3536f4a28c787746733b0167d0816d544606150b8027e3ed1457fae6e3578163ccb0e115dcf202b92093f2e3374ff7002cc7aa064614395c

  • SSDEEP

    12288:yrV7j7aEcAhsiTE257jusUNIj7b1ATP30t3L88cnQ7bbbbbbbbbbbbbbbbbbbbbp:0V7f4Am32VusUNIj7GT/IL88cnObbbbl

Malware Config

Targets

    • Target

      240751d8c98257456ef6583c41d96e88c5c66ef699d35ab93f346ee889a6c981

    • Size

      634KB

    • MD5

      4e476f99ee7e271e734179b3683afcb0

    • SHA1

      1a0e3b22b8466ca2475287558b94c5c6ec59d85c

    • SHA256

      240751d8c98257456ef6583c41d96e88c5c66ef699d35ab93f346ee889a6c981

    • SHA512

      ecf5cd557727768b3536f4a28c787746733b0167d0816d544606150b8027e3ed1457fae6e3578163ccb0e115dcf202b92093f2e3374ff7002cc7aa064614395c

    • SSDEEP

      12288:yrV7j7aEcAhsiTE257jusUNIj7b1ATP30t3L88cnQ7bbbbbbbbbbbbbbbbbbbbbp:0V7f4Am32VusUNIj7GT/IL88cnObbbbl

    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks