Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df

  • Size

    1.6MB

  • Sample

    221129-qlxgysfb7x

  • MD5

    aea89e584baa3cdb4bc42f62f798ac5c

  • SHA1

    126024decb74c300579bb844451e6a17a383d6f0

  • SHA256

    dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df

  • SHA512

    6faa1eaefa08f0c71fd40ce6e4379a28d8211aa53ed755d0d9106a15dce4252b7c67d80a3d5a0a379262462c2c43b97223fe2484fed0de69b77729bde0eb299e

  • SSDEEP

    49152:nYqRvbfHLZW2Uf9SLukd3W0C1dySncCZ8W4z:/RjlW22ULuiW5xcCZEz

Malware Config

Targets

    • Target

      dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df

    • Size

      1.6MB

    • MD5

      aea89e584baa3cdb4bc42f62f798ac5c

    • SHA1

      126024decb74c300579bb844451e6a17a383d6f0

    • SHA256

      dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df

    • SHA512

      6faa1eaefa08f0c71fd40ce6e4379a28d8211aa53ed755d0d9106a15dce4252b7c67d80a3d5a0a379262462c2c43b97223fe2484fed0de69b77729bde0eb299e

    • SSDEEP

      49152:nYqRvbfHLZW2Uf9SLukd3W0C1dySncCZ8W4z:/RjlW22ULuiW5xcCZEz

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Registers COM server for autorun

    • Sets file execution options in registry

    • Sets service image path in registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Program crash

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks