Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NEAS.4e563d84c6b217afe7c56add4dd84d60.exe

  • Size

    70KB

  • Sample

    231013-y54pdabd42

  • MD5

    4e563d84c6b217afe7c56add4dd84d60

  • SHA1

    641d2fbc97225ffbd65d83cb73094316ba2547e2

  • SHA256

    191ea4a15f344e7f68660ed1fac5494f0467f27fb2c02d62620631fc66cc4c50

  • SHA512

    0e7818f64007a75066fe47a55f3ef04fac54f99763d1d0fc83cb122bedf20a27d8db1176e25a81f3a755fbdf13fe02c8cb8b276bc6ee3210d64ff63a63e22363

  • SSDEEP

    1536:Jq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9b1YTjipvF2a:Jq5ud9qHFO8Kf3rIIb1YvQd2a

Malware Config

Targets

    • Target

      NEAS.4e563d84c6b217afe7c56add4dd84d60.exe

    • Size

      70KB

    • MD5

      4e563d84c6b217afe7c56add4dd84d60

    • SHA1

      641d2fbc97225ffbd65d83cb73094316ba2547e2

    • SHA256

      191ea4a15f344e7f68660ed1fac5494f0467f27fb2c02d62620631fc66cc4c50

    • SHA512

      0e7818f64007a75066fe47a55f3ef04fac54f99763d1d0fc83cb122bedf20a27d8db1176e25a81f3a755fbdf13fe02c8cb8b276bc6ee3210d64ff63a63e22363

    • SSDEEP

      1536:Jq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9b1YTjipvF2a:Jq5ud9qHFO8Kf3rIIb1YvQd2a

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks