Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    eddf8c0e68f85cb94e81f5572dfb5e9e08bedd0631e078abc755b7b0ad903380_GoTo Webinar Opener.exe

  • Size

    375KB

  • Sample

    231016-g5rw5seb85

  • MD5

    144f6ae304e73dd2d8142c83e0c60d98

  • SHA1

    f75f084f6ebc75d271573c1a1a969529c5fd251d

  • SHA256

    eddf8c0e68f85cb94e81f5572dfb5e9e08bedd0631e078abc755b7b0ad903380

  • SHA512

    8c69eeeee5c567a2afe38b045a7da048d111478b56d37282f038a022f39472b74f39dd236a84e6197b63c9ea89cb77ceacca5b4f1296945d341c5e31b27d2095

  • SSDEEP

    6144:4VvaoFGmgG0BCGxcKi7ZIhFn6ZlrctG9KaVs/BfUbGy/kZiy1aqTWunoSDw6BLyj:wvz+GKK7ZCFgctGzVhlUiCLThoSDwAej

Malware Config

Targets

    • Target

      eddf8c0e68f85cb94e81f5572dfb5e9e08bedd0631e078abc755b7b0ad903380_GoTo Webinar Opener.exe

    • Size

      375KB

    • MD5

      144f6ae304e73dd2d8142c83e0c60d98

    • SHA1

      f75f084f6ebc75d271573c1a1a969529c5fd251d

    • SHA256

      eddf8c0e68f85cb94e81f5572dfb5e9e08bedd0631e078abc755b7b0ad903380

    • SHA512

      8c69eeeee5c567a2afe38b045a7da048d111478b56d37282f038a022f39472b74f39dd236a84e6197b63c9ea89cb77ceacca5b4f1296945d341c5e31b27d2095

    • SSDEEP

      6144:4VvaoFGmgG0BCGxcKi7ZIhFn6ZlrctG9KaVs/BfUbGy/kZiy1aqTWunoSDw6BLyj:wvz+GKK7ZCFgctGzVhlUiCLThoSDwAej

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks