Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    50e31772b950a0exeexeexeex.exe

  • Size

    2.6MB

  • Sample

    230707-w3l1faae74

  • MD5

    50e31772b950a09f6eb7a6958741eb30

  • SHA1

    f34e48977cec18c850b41e89d21aad039ef90323

  • SHA256

    cf7d56e3289c5e1993dfb0732961fce84b1522b7482b1445e92846f6dc70c0f7

  • SHA512

    592803e81fe12261e18bde40722dc95d5d6793338f988c3ce3b08b29780dd6bf5672bf62f38ddb76a38d3f5f424b11da40ec13a52cf0e77fc375315ba2ae03f1

  • SSDEEP

    24576:BcawzIhsmH5UiL6h3bBip1etFi8ZaM3MDG1MfuqS8CkCzH3BCtJzDYqI1f9FaK7:XhDHCBCYtYG1MWqhlkBCtJzDJWfXh

Malware Config

Targets

    • Target

      50e31772b950a0exeexeexeex.exe

    • Size

      2.6MB

    • MD5

      50e31772b950a09f6eb7a6958741eb30

    • SHA1

      f34e48977cec18c850b41e89d21aad039ef90323

    • SHA256

      cf7d56e3289c5e1993dfb0732961fce84b1522b7482b1445e92846f6dc70c0f7

    • SHA512

      592803e81fe12261e18bde40722dc95d5d6793338f988c3ce3b08b29780dd6bf5672bf62f38ddb76a38d3f5f424b11da40ec13a52cf0e77fc375315ba2ae03f1

    • SSDEEP

      24576:BcawzIhsmH5UiL6h3bBip1etFi8ZaM3MDG1MfuqS8CkCzH3BCtJzDYqI1f9FaK7:XhDHCBCYtYG1MWqhlkBCtJzDJWfXh

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks