Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    360TS_Setup.exe

  • Size

    88.1MB

  • Sample

    230614-xez3tscf6y

  • MD5

    1acc75efbf995f67cbdd73bb1c8129dc

  • SHA1

    f27f71ff739f7255fc77cd14842771d17830f455

  • SHA256

    690443b9a2337ece062c8cc876e71bdc1561abebb725116b7ed9761b8b766c64

  • SHA512

    ce99fac2268ae39d23fb07a0a0b10512c663ac1414254b93c597364b81b2f4c57c0eb4576f8803a7e324881a9810396b9bf5e2d39c2cddbe620093cc1f11ef65

  • SSDEEP

    1572864:IwqqNV672XXjBhT4CCbliN+lRtPk9sNRPLp8vt011XxSmfOpvf19XBy:LN/XPCMwHk9svLpctk1XxgpXDBy

Malware Config

Targets

    • Target

      360TS_Setup.exe

    • Size

      88.1MB

    • MD5

      1acc75efbf995f67cbdd73bb1c8129dc

    • SHA1

      f27f71ff739f7255fc77cd14842771d17830f455

    • SHA256

      690443b9a2337ece062c8cc876e71bdc1561abebb725116b7ed9761b8b766c64

    • SHA512

      ce99fac2268ae39d23fb07a0a0b10512c663ac1414254b93c597364b81b2f4c57c0eb4576f8803a7e324881a9810396b9bf5e2d39c2cddbe620093cc1f11ef65

    • SSDEEP

      1572864:IwqqNV672XXjBhT4CCbliN+lRtPk9sNRPLp8vt011XxSmfOpvf19XBy:LN/XPCMwHk9svLpctk1XxgpXDBy

    • Modifies boot configuration data using bcdedit

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

    • Sets service image path in registry

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks