Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    66d24df1d79f22e5e90605e058fc743079c60a545a7f9091ee99e1a8e1c4e29e

  • Size

    479KB

  • Sample

    230506-nl9feagh98

  • MD5

    18a19d3ec438dd5e511e29c0d1a1dc2b

  • SHA1

    d6b509d44463eb20f7f96417fc8a1391e465194f

  • SHA256

    66d24df1d79f22e5e90605e058fc743079c60a545a7f9091ee99e1a8e1c4e29e

  • SHA512

    7debbd21f709ffe99c4bb264c80f03adfabf779fdf5736fae08faaa74fad24e4b2613b77de565bb482df98ee99804e045ac061c38de16d569bb3d675c5bea22b

  • SSDEEP

    12288:4Mriy90GElcBlsFCZ0zFqPyll8DI0HDbI1hPGAV:6yGGlsFCZ0zFwyvbebwbV

Malware Config

Targets

    • Target

      66d24df1d79f22e5e90605e058fc743079c60a545a7f9091ee99e1a8e1c4e29e

    • Size

      479KB

    • MD5

      18a19d3ec438dd5e511e29c0d1a1dc2b

    • SHA1

      d6b509d44463eb20f7f96417fc8a1391e465194f

    • SHA256

      66d24df1d79f22e5e90605e058fc743079c60a545a7f9091ee99e1a8e1c4e29e

    • SHA512

      7debbd21f709ffe99c4bb264c80f03adfabf779fdf5736fae08faaa74fad24e4b2613b77de565bb482df98ee99804e045ac061c38de16d569bb3d675c5bea22b

    • SSDEEP

      12288:4Mriy90GElcBlsFCZ0zFqPyll8DI0HDbI1hPGAV:6yGGlsFCZ0zFwyvbebwbV

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks