Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0178cc428a83e0c8beb4a00d34fec0adcb8d49654cf9c6a9f0c8c426ec97b290

  • Size

    1.1MB

  • Sample

    230426-tka44sad66

  • MD5

    9e95d01b6f32ac176bf76593a30f5038

  • SHA1

    29d4857f0c43e15bc7d7fd6da9ea2674ffac166a

  • SHA256

    0178cc428a83e0c8beb4a00d34fec0adcb8d49654cf9c6a9f0c8c426ec97b290

  • SHA512

    20f7dd277b65016884979eb1d69aafac2f685cc2f27d8c5a1ce5bf415b01536aa8ec75303c4a765f35cf8819d66b408a5d6a3d6499b964083d3c67c5277cc9dc

  • SSDEEP

    24576:KyEUFH8mjjH/Rh1YcSj4XBPhaxaddmr1gqWhLTOUtRFMTHQ:RpV8IjJknjeBPIxaddukhLaUlMT

Malware Config

Targets

    • Target

      0178cc428a83e0c8beb4a00d34fec0adcb8d49654cf9c6a9f0c8c426ec97b290

    • Size

      1.1MB

    • MD5

      9e95d01b6f32ac176bf76593a30f5038

    • SHA1

      29d4857f0c43e15bc7d7fd6da9ea2674ffac166a

    • SHA256

      0178cc428a83e0c8beb4a00d34fec0adcb8d49654cf9c6a9f0c8c426ec97b290

    • SHA512

      20f7dd277b65016884979eb1d69aafac2f685cc2f27d8c5a1ce5bf415b01536aa8ec75303c4a765f35cf8819d66b408a5d6a3d6499b964083d3c67c5277cc9dc

    • SSDEEP

      24576:KyEUFH8mjjH/Rh1YcSj4XBPhaxaddmr1gqWhLTOUtRFMTHQ:RpV8IjJknjeBPIxaddukhLaUlMT

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks