Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    uinnzbn-aea-8.gq_-_hyper_-_labd.exe___2e1c1deb19d592e3632995a26a329ea5.dat

  • Size

    6KB

  • Sample

    230201-llf3racg43

  • MD5

    2e1c1deb19d592e3632995a26a329ea5

  • SHA1

    d0cfbee2d48955f00de70785f18b6c42ea453efe

  • SHA256

    f23a860bb50b861a74c8a45265e14ea81a461bfd4081c790f4caf51d829284c1

  • SHA512

    9696198a69a51d506cbc3ec777f717aa9232c6061b790eddc3740881de8427e93760b75b0211c0c2ec89e0bf7e0c222002aa11e61139817f8a90d6c0560a58cf

  • SSDEEP

    96:2XvqpKge6jUCuNXZ5hpWLzpRL2oHIvkuixOBzNt:2tw3uRZ5hpWLt9LFu4OD

Malware Config

Targets

    • Target

      uinnzbn-aea-8.gq_-_hyper_-_labd.exe___2e1c1deb19d592e3632995a26a329ea5.dat

    • Size

      6KB

    • MD5

      2e1c1deb19d592e3632995a26a329ea5

    • SHA1

      d0cfbee2d48955f00de70785f18b6c42ea453efe

    • SHA256

      f23a860bb50b861a74c8a45265e14ea81a461bfd4081c790f4caf51d829284c1

    • SHA512

      9696198a69a51d506cbc3ec777f717aa9232c6061b790eddc3740881de8427e93760b75b0211c0c2ec89e0bf7e0c222002aa11e61139817f8a90d6c0560a58cf

    • SSDEEP

      96:2XvqpKge6jUCuNXZ5hpWLzpRL2oHIvkuixOBzNt:2tw3uRZ5hpWLt9LFu4OD

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks