Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ff773ba71ce9b9e3f3924643fabaf13101471867bd5408e425bc74b1aeb8e9b3

  • Size

    477KB

  • Sample

    221106-x832kshba5

  • MD5

    0f7e341af71c96b0c2cc3099b69219d0

  • SHA1

    981e5189b1ec0b10fd03b8a248ccda9ac3e2f2fd

  • SHA256

    ff773ba71ce9b9e3f3924643fabaf13101471867bd5408e425bc74b1aeb8e9b3

  • SHA512

    53a19e4a848a52a232ef7ed5402d90819902dea1e66a58bb8e9d55a9ae1ae0968858788f02bfeafc06bd14a18958aee4571e2c5504c264e5f15c2996d8d0dc97

  • SSDEEP

    12288:ZwQmLBIl9rJndyioSVJkpS5X7NVAEPwEPE1z/uvC/uuh/u8Y+gKr+6/u2mC9eBw4:uMMioSqmX7NVAEPwEPE1z/uvC/uuh/uB

Malware Config

Targets

    • Target

      ff773ba71ce9b9e3f3924643fabaf13101471867bd5408e425bc74b1aeb8e9b3

    • Size

      477KB

    • MD5

      0f7e341af71c96b0c2cc3099b69219d0

    • SHA1

      981e5189b1ec0b10fd03b8a248ccda9ac3e2f2fd

    • SHA256

      ff773ba71ce9b9e3f3924643fabaf13101471867bd5408e425bc74b1aeb8e9b3

    • SHA512

      53a19e4a848a52a232ef7ed5402d90819902dea1e66a58bb8e9d55a9ae1ae0968858788f02bfeafc06bd14a18958aee4571e2c5504c264e5f15c2996d8d0dc97

    • SSDEEP

      12288:ZwQmLBIl9rJndyioSVJkpS5X7NVAEPwEPE1z/uvC/uuh/u8Y+gKr+6/u2mC9eBw4:uMMioSqmX7NVAEPwEPE1z/uvC/uuh/uB

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks