Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    994d847c56d572d7fddd4e8b818a27a22a4c3d8ba118cfe6a016abca0799982b

  • Size

    480KB

  • Sample

    230505-xr2r7afh88

  • MD5

    bb577a58b3d6b4940ac01f5c6995da05

  • SHA1

    e300fdea137762e890ab5f11dab34b2570971e43

  • SHA256

    994d847c56d572d7fddd4e8b818a27a22a4c3d8ba118cfe6a016abca0799982b

  • SHA512

    0b8691302337bd6244ee6818e6d03b7c7343c5898feea36710d551915d86c5e369d5b953de9dda1a5f2290bcef1fe8683408095d041472383ec7ba062d0771f8

  • SSDEEP

    6144:KAy+bnr+Bp0yN90QEmtN5htQs/Q8rpZNVaGby5y2DEdXm6KZoS771JMagwzDlPZ3:AMrxy90lsYQBLbyMlKWSXMaVPZJlAW

Malware Config

Targets

    • Target

      994d847c56d572d7fddd4e8b818a27a22a4c3d8ba118cfe6a016abca0799982b

    • Size

      480KB

    • MD5

      bb577a58b3d6b4940ac01f5c6995da05

    • SHA1

      e300fdea137762e890ab5f11dab34b2570971e43

    • SHA256

      994d847c56d572d7fddd4e8b818a27a22a4c3d8ba118cfe6a016abca0799982b

    • SHA512

      0b8691302337bd6244ee6818e6d03b7c7343c5898feea36710d551915d86c5e369d5b953de9dda1a5f2290bcef1fe8683408095d041472383ec7ba062d0771f8

    • SSDEEP

      6144:KAy+bnr+Bp0yN90QEmtN5htQs/Q8rpZNVaGby5y2DEdXm6KZoS771JMagwzDlPZ3:AMrxy90lsYQBLbyMlKWSXMaVPZJlAW

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.