Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ff6854a409f6477d5272a7d93df87e68794e56d7c943c89236c2841cb15b35e4

  • Size

    989KB

  • Sample

    221030-19b62adad5

  • MD5

    830072cd2260f8810a8086add9d9c6e0

  • SHA1

    e1a9b7fecb8d3b7bf4723e700a46688b0b561b50

  • SHA256

    ff6854a409f6477d5272a7d93df87e68794e56d7c943c89236c2841cb15b35e4

  • SHA512

    ea0a20faf1f661af4057a82932acb8843fba64c5fe1318e504ce1281e0022496476726782456c783f10ea36df16b87371f365037856ac4d305ba199ff5c4653d

  • SSDEEP

    24576:wQXtbnvMFKM5qZiowaE471LNPEncIJzqNrXkdMBjLWw3auh4zgR0K8/F1d7Yh:wQXtbn2KM5QiLbELNocIlqWMew3auh4F

Malware Config

Targets

    • Target

      ff6854a409f6477d5272a7d93df87e68794e56d7c943c89236c2841cb15b35e4

    • Size

      989KB

    • MD5

      830072cd2260f8810a8086add9d9c6e0

    • SHA1

      e1a9b7fecb8d3b7bf4723e700a46688b0b561b50

    • SHA256

      ff6854a409f6477d5272a7d93df87e68794e56d7c943c89236c2841cb15b35e4

    • SHA512

      ea0a20faf1f661af4057a82932acb8843fba64c5fe1318e504ce1281e0022496476726782456c783f10ea36df16b87371f365037856ac4d305ba199ff5c4653d

    • SSDEEP

      24576:wQXtbnvMFKM5qZiowaE471LNPEncIJzqNrXkdMBjLWw3auh4zgR0K8/F1d7Yh:wQXtbn2KM5QiLbELNocIlqWMew3auh4F

    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks