Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6704de0ede035873f57ce22930f3d3b0e23ba418723be70870916c330d818c27

  • Size

    345KB

  • Sample

    230719-s8zlyahe24

  • MD5

    0c1b604be07688870ec06c103e1964af

  • SHA1

    7efcfaab06b82f6c9cc11d02d626533b6c936e27

  • SHA256

    6704de0ede035873f57ce22930f3d3b0e23ba418723be70870916c330d818c27

  • SHA512

    f70cc1b29870f17a97fc857448bd3546f05c98951a37c2286ce131821bf6eea6f9f63c0f82b897b1b2283e35f64684af9b6db376630570cd06ad7be343cddfb7

  • SSDEEP

    6144:zvlQKneRk8Z4jNU3bhB0uKJsx5kpOOyyG:mKnIfujNq9WDsfN5y

Malware Config

Targets

    • Target

      6704de0ede035873f57ce22930f3d3b0e23ba418723be70870916c330d818c27

    • Size

      345KB

    • MD5

      0c1b604be07688870ec06c103e1964af

    • SHA1

      7efcfaab06b82f6c9cc11d02d626533b6c936e27

    • SHA256

      6704de0ede035873f57ce22930f3d3b0e23ba418723be70870916c330d818c27

    • SHA512

      f70cc1b29870f17a97fc857448bd3546f05c98951a37c2286ce131821bf6eea6f9f63c0f82b897b1b2283e35f64684af9b6db376630570cd06ad7be343cddfb7

    • SSDEEP

      6144:zvlQKneRk8Z4jNU3bhB0uKJsx5kpOOyyG:mKnIfujNq9WDsfN5y

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks