Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e89450b226086995c372afd2b8457467d63c71a6cbde91ba3ea142bede85404a

  • Size

    479KB

  • Sample

    221106-x9h3sshbb7

  • MD5

    091b6e4511ae431c81e62025d55fa050

  • SHA1

    474df2da9dd33141e6bc5c1554d363567a6b112b

  • SHA256

    e89450b226086995c372afd2b8457467d63c71a6cbde91ba3ea142bede85404a

  • SHA512

    1190ad1064d8b2413094a065efbdc9ff35adc97013b3e744f18d5a80d086271556fd4b665c3936503e43db30cd05dece2f95b87bdc4e8c25c181eae03a046900

  • SSDEEP

    12288:MaocVmajhxkJgbswZpM/+FphU47WTI/2Sv7xww846I39:TVmajhsgAwvMGphUkWTvEKrmN

Malware Config

Targets

    • Target

      e89450b226086995c372afd2b8457467d63c71a6cbde91ba3ea142bede85404a

    • Size

      479KB

    • MD5

      091b6e4511ae431c81e62025d55fa050

    • SHA1

      474df2da9dd33141e6bc5c1554d363567a6b112b

    • SHA256

      e89450b226086995c372afd2b8457467d63c71a6cbde91ba3ea142bede85404a

    • SHA512

      1190ad1064d8b2413094a065efbdc9ff35adc97013b3e744f18d5a80d086271556fd4b665c3936503e43db30cd05dece2f95b87bdc4e8c25c181eae03a046900

    • SSDEEP

      12288:MaocVmajhxkJgbswZpM/+FphU47WTI/2Sv7xww846I39:TVmajhsgAwvMGphUkWTvEKrmN

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks