Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f6864632b139d20a646bd929fb8ccebc1b1e17a4765d2d4f4ddc3d1a8f6ceb30

  • Size

    993KB

  • Sample

    221106-x88basbefm

  • MD5

    032ec4a22b674cb1ea5ba73b6b93c490

  • SHA1

    ae6a118b1d2686730d29ffddbb46d6a25f11ce66

  • SHA256

    f6864632b139d20a646bd929fb8ccebc1b1e17a4765d2d4f4ddc3d1a8f6ceb30

  • SHA512

    d8747d956ecfdcc85792cd6c7434b52a5cb117f47508762bfdcec0b3919c09c1a0f1e937b6bfc4eed9fac3554304715ef38536032cb79d557fd34c8f5b5e45be

  • SSDEEP

    24576:Th/LHJTW/SpiiWs4m2hiATWUuVPVOjhlaC6B4U50Xj0EuyVE/ZJ++4MuGIvLKFS3:NLHgbsuNcxQujYvLKFSmA+KO6f

Malware Config

Targets

    • Target

      f6864632b139d20a646bd929fb8ccebc1b1e17a4765d2d4f4ddc3d1a8f6ceb30

    • Size

      993KB

    • MD5

      032ec4a22b674cb1ea5ba73b6b93c490

    • SHA1

      ae6a118b1d2686730d29ffddbb46d6a25f11ce66

    • SHA256

      f6864632b139d20a646bd929fb8ccebc1b1e17a4765d2d4f4ddc3d1a8f6ceb30

    • SHA512

      d8747d956ecfdcc85792cd6c7434b52a5cb117f47508762bfdcec0b3919c09c1a0f1e937b6bfc4eed9fac3554304715ef38536032cb79d557fd34c8f5b5e45be

    • SSDEEP

      24576:Th/LHJTW/SpiiWs4m2hiATWUuVPVOjhlaC6B4U50Xj0EuyVE/ZJ++4MuGIvLKFS3:NLHgbsuNcxQujYvLKFSmA+KO6f

    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks