Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15

  • Size

    255KB

  • Sample

    221014-msk6qabgcm

  • MD5

    041517df62f8e841367468104014d91a

  • SHA1

    469d197f59194f70a58941921de4c14c86f4dceb

  • SHA256

    cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15

  • SHA512

    0ae84ae5977380d411ba41917c94446a98361dcff643cb952a69317e925470dcc0e18c5069b2be49e0a08e8eeb43343466815bdab5d438a0ca7d71aa0f017d66

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI2

Malware Config

Targets

    • Target

      cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15

    • Size

      255KB

    • MD5

      041517df62f8e841367468104014d91a

    • SHA1

      469d197f59194f70a58941921de4c14c86f4dceb

    • SHA256

      cd0156a292ab30feb1503fc1bde45dfa849d947c116ed17a1520923f7e19ed15

    • SHA512

      0ae84ae5977380d411ba41917c94446a98361dcff643cb952a69317e925470dcc0e18c5069b2be49e0a08e8eeb43343466815bdab5d438a0ca7d71aa0f017d66

    • SSDEEP

      3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI2

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.