Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    24c8c4215809438956aa2fcdfa0eca28aba0325a18a2222df4a8a032b90f9d60

  • Size

    1.5MB

  • Sample

    230420-lzrfmsha72

  • MD5

    f41921691e0f83d4ba3ea1dc320cb45c

  • SHA1

    8ea2e955b348b65ceea7b47dc9f3514752d9f2e3

  • SHA256

    24c8c4215809438956aa2fcdfa0eca28aba0325a18a2222df4a8a032b90f9d60

  • SHA512

    7511417071d9a1a50375cd91503db82e75a8226f03faea9f60f8b0842d801ef0106afcc160f88a0563c8eed221ece535d059d04ebb4ddfdb64dffbff66565c5d

  • SSDEEP

    49152:4vw8hVfTkyoVa0McqYmESINqecsorgqc:qw8jIyoo0MvPEmzsoQ

Malware Config

Targets

    • Target

      24c8c4215809438956aa2fcdfa0eca28aba0325a18a2222df4a8a032b90f9d60

    • Size

      1.5MB

    • MD5

      f41921691e0f83d4ba3ea1dc320cb45c

    • SHA1

      8ea2e955b348b65ceea7b47dc9f3514752d9f2e3

    • SHA256

      24c8c4215809438956aa2fcdfa0eca28aba0325a18a2222df4a8a032b90f9d60

    • SHA512

      7511417071d9a1a50375cd91503db82e75a8226f03faea9f60f8b0842d801ef0106afcc160f88a0563c8eed221ece535d059d04ebb4ddfdb64dffbff66565c5d

    • SSDEEP

      49152:4vw8hVfTkyoVa0McqYmESINqecsorgqc:qw8jIyoo0MvPEmzsoQ

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks