Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435

  • Size

    481KB

  • Sample

    221204-nwtspseh67

  • MD5

    c48f179e0015278c3e1c35c23918e395

  • SHA1

    20f47f3051d785604692115c92715d6edbafa47b

  • SHA256

    d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435

  • SHA512

    de8dc3dac71eb06134cc21bca8effdbd915fb0fbdbb404311a180498c453e53daf02a19b0c4d6953e31932a446b9212c7f85c6794e9aff8ec56e8819539db393

  • SSDEEP

    12288:DDNkFa5fF7RTX979xwJyTW7DsVpCSmGiHyJC+S8h:DJ+gF1tTyyTW7Cp13C0

Malware Config

Targets

    • Target

      d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435

    • Size

      481KB

    • MD5

      c48f179e0015278c3e1c35c23918e395

    • SHA1

      20f47f3051d785604692115c92715d6edbafa47b

    • SHA256

      d34a401fe354334c503f721eba569d9200115cf413bb0a76d336c584a13f8435

    • SHA512

      de8dc3dac71eb06134cc21bca8effdbd915fb0fbdbb404311a180498c453e53daf02a19b0c4d6953e31932a446b9212c7f85c6794e9aff8ec56e8819539db393

    • SSDEEP

      12288:DDNkFa5fF7RTX979xwJyTW7DsVpCSmGiHyJC+S8h:DJ+gF1tTyyTW7Cp13C0

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks