Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8c1d9f4b035fca2cbaf79983b8874b44daa55587134b06f9f4a521e2cec0e739

  • Size

    512KB

  • Sample

    221106-tktapacfeq

  • MD5

    0e63f45c2d3ab50c8a0048077bcc7260

  • SHA1

    410c56790d05f4743f7fb98c86b5d36601d4f41c

  • SHA256

    8c1d9f4b035fca2cbaf79983b8874b44daa55587134b06f9f4a521e2cec0e739

  • SHA512

    689f6501d5cd44d6ec9f313417cc8ed9a05c5d0cc60a1b46c7f9ff642d5325b35e1c7b0e8c95d1826bd8bc6722bd49767f18cc78bdd24509d386885673039596

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Malware Config

Targets

    • Target

      8c1d9f4b035fca2cbaf79983b8874b44daa55587134b06f9f4a521e2cec0e739

    • Size

      512KB

    • MD5

      0e63f45c2d3ab50c8a0048077bcc7260

    • SHA1

      410c56790d05f4743f7fb98c86b5d36601d4f41c

    • SHA256

      8c1d9f4b035fca2cbaf79983b8874b44daa55587134b06f9f4a521e2cec0e739

    • SHA512

      689f6501d5cd44d6ec9f313417cc8ed9a05c5d0cc60a1b46c7f9ff642d5325b35e1c7b0e8c95d1826bd8bc6722bd49767f18cc78bdd24509d386885673039596

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks