Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    643ab82e4a13dea1ab701abe624297a807ab7bff402f907ec88746f89b6b6fb5

  • Size

    480KB

  • Sample

    230505-xlg6lafd56

  • MD5

    0debfd30bdf82d783355e402a2759036

  • SHA1

    7dac22f013f021b07337e73cdc12d42a93bbfde4

  • SHA256

    643ab82e4a13dea1ab701abe624297a807ab7bff402f907ec88746f89b6b6fb5

  • SHA512

    ed8a9cd533704e88e303369dabb2901feece68bfdd25136a3a253141d304214178f530004c867b06db3398b56c18c455eabeebf6d87eec1da2f61004c6fc2eaa

  • SSDEEP

    12288:VMrNy90I1ohTera3KRp3zTSIPpi6opvGw+F:wyV1ohKG8pDrhgF8

Malware Config

Targets

    • Target

      643ab82e4a13dea1ab701abe624297a807ab7bff402f907ec88746f89b6b6fb5

    • Size

      480KB

    • MD5

      0debfd30bdf82d783355e402a2759036

    • SHA1

      7dac22f013f021b07337e73cdc12d42a93bbfde4

    • SHA256

      643ab82e4a13dea1ab701abe624297a807ab7bff402f907ec88746f89b6b6fb5

    • SHA512

      ed8a9cd533704e88e303369dabb2901feece68bfdd25136a3a253141d304214178f530004c867b06db3398b56c18c455eabeebf6d87eec1da2f61004c6fc2eaa

    • SSDEEP

      12288:VMrNy90I1ohTera3KRp3zTSIPpi6opvGw+F:wyV1ohKG8pDrhgF8

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks