Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0fe036c058d392940589128f02aa43a493b9702010e32c90e0c51e20ffdeee12

  • Size

    5.9MB

  • Sample

    221017-ja18fabbdl

  • MD5

    b445675dc4be05a4333d7350352d7d5e

  • SHA1

    4d43859a9836db23f72bf272840004d4b3e41d33

  • SHA256

    0fe036c058d392940589128f02aa43a493b9702010e32c90e0c51e20ffdeee12

  • SHA512

    4cafcd1f850fe95d2cd5bb246153ab1db42cc4223e46ef7422a296e4c21d2f8734ba88bc4fcd7f75d31647bdee18748ad7687f2cf67279e424d84a11eb70d079

  • SSDEEP

    49152:ujLuSh3i+FtvkMzT+8Re0ZGxbxcgsIsTZm:yLu1g9ZGlWrfTZm

Malware Config

Targets

    • Target

      0fe036c058d392940589128f02aa43a493b9702010e32c90e0c51e20ffdeee12

    • Size

      5.9MB

    • MD5

      b445675dc4be05a4333d7350352d7d5e

    • SHA1

      4d43859a9836db23f72bf272840004d4b3e41d33

    • SHA256

      0fe036c058d392940589128f02aa43a493b9702010e32c90e0c51e20ffdeee12

    • SHA512

      4cafcd1f850fe95d2cd5bb246153ab1db42cc4223e46ef7422a296e4c21d2f8734ba88bc4fcd7f75d31647bdee18748ad7687f2cf67279e424d84a11eb70d079

    • SSDEEP

      49152:ujLuSh3i+FtvkMzT+8Re0ZGxbxcgsIsTZm:yLu1g9ZGlWrfTZm

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v6

Tasks