Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8

  • Size

    1.1MB

  • Sample

    230420-mdxafahc42

  • MD5

    0db7b764ead6447da3ac2c7f6b1518fe

  • SHA1

    953bf9dd4040e093ffbc80aa218ee58282a308f8

  • SHA256

    602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8

  • SHA512

    969e8f247a875bf99afbebc6591e324cafe72f3d40635f54f77ec743fd6a6c5d4044185c88fea7a8c48793c7fd63d8b1ef5f16d60c248b8597b31f675473c212

  • SSDEEP

    24576:byZDmN3ARMiKtS5PqVgqgdERp0Y7Up8PfR49I1TSe/pDBAM:OZqaRMttcygPWp/A8PfC61TS

Malware Config

Targets

    • Target

      602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8

    • Size

      1.1MB

    • MD5

      0db7b764ead6447da3ac2c7f6b1518fe

    • SHA1

      953bf9dd4040e093ffbc80aa218ee58282a308f8

    • SHA256

      602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8

    • SHA512

      969e8f247a875bf99afbebc6591e324cafe72f3d40635f54f77ec743fd6a6c5d4044185c88fea7a8c48793c7fd63d8b1ef5f16d60c248b8597b31f675473c212

    • SSDEEP

      24576:byZDmN3ARMiKtS5PqVgqgdERp0Y7Up8PfR49I1TSe/pDBAM:OZqaRMttcygPWp/A8PfC61TS

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks