Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    fb774fa86611afde3454f86f313a413424cfc83b1fc8aa38914bb0b515541430

  • Size

    800KB

  • Sample

    221121-k8yqmscg74

  • MD5

    3b5454ece3eb22f1a040a4f23c6d1d50

  • SHA1

    3ddd0b58050b43cab7e3849a3b4f5a670e88002d

  • SHA256

    fb774fa86611afde3454f86f313a413424cfc83b1fc8aa38914bb0b515541430

  • SHA512

    b451c48542abd51dcb7c3253797c5d97a42498f372c8faf931c3612cd57d8d281201750a49d1af0cd3882d159405df8e5547b0498deb55d369fe40ed524449d2

  • SSDEEP

    12288:YDLbbE8lLMqMQ+M1olEAMa+iwqcJ2NzNDdNRq9RJivGjyBdIUraKfIlnE0c:SLbDT8lHML7JqJRNR6ivVdIXlET

Malware Config

Targets

    • Target

      fb774fa86611afde3454f86f313a413424cfc83b1fc8aa38914bb0b515541430

    • Size

      800KB

    • MD5

      3b5454ece3eb22f1a040a4f23c6d1d50

    • SHA1

      3ddd0b58050b43cab7e3849a3b4f5a670e88002d

    • SHA256

      fb774fa86611afde3454f86f313a413424cfc83b1fc8aa38914bb0b515541430

    • SHA512

      b451c48542abd51dcb7c3253797c5d97a42498f372c8faf931c3612cd57d8d281201750a49d1af0cd3882d159405df8e5547b0498deb55d369fe40ed524449d2

    • SSDEEP

      12288:YDLbbE8lLMqMQ+M1olEAMa+iwqcJ2NzNDdNRq9RJivGjyBdIUraKfIlnE0c:SLbDT8lHML7JqJRNR6ivVdIXlET

    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks