Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    197KB

  • Sample

    230209-m71jyshe4z

  • MD5

    b57f210e5cc5a837428e875730351869

  • SHA1

    5260fc6290c4db2d9b7db3f7870630fa992e9f84

  • SHA256

    2a0e3a1a6d6bad4374a6cb4a81eedb71c62851794570e6c1a34a50934da503fd

  • SHA512

    e8c41984901c61223a0e67b70c56af5cafb0e4ac95d107a1d89062369c33db18e31663ada21c5332bf440ddab28da7616de9f35994c819279dba1e52e225d032

  • SSDEEP

    3072:vhOORNBlU2tQFLE0kWoh5KIauA9BhQFHoD1TuN6pLIzdUjcgW0z:vhO2iFLnkmaFHsuN6pLiPL

Malware Config

Targets

    • Target

      tmp

    • Size

      197KB

    • MD5

      b57f210e5cc5a837428e875730351869

    • SHA1

      5260fc6290c4db2d9b7db3f7870630fa992e9f84

    • SHA256

      2a0e3a1a6d6bad4374a6cb4a81eedb71c62851794570e6c1a34a50934da503fd

    • SHA512

      e8c41984901c61223a0e67b70c56af5cafb0e4ac95d107a1d89062369c33db18e31663ada21c5332bf440ddab28da7616de9f35994c819279dba1e52e225d032

    • SSDEEP

      3072:vhOORNBlU2tQFLE0kWoh5KIauA9BhQFHoD1TuN6pLIzdUjcgW0z:vhO2iFLnkmaFHsuN6pLiPL

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks