Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0c4b93248f879c55af0dbadabbfbcbd3.exe

  • Size

    200KB

  • Sample

    231126-twjkmaad54

  • MD5

    0c4b93248f879c55af0dbadabbfbcbd3

  • SHA1

    28f43c6a01ca3ee74ca1fc05bb37524a63fcc3da

  • SHA256

    193cd25a701fee258502ce638347a3a94ca4dcb82acba581fb3faafdf4dfe9ae

  • SHA512

    eba37ec05745ebb2848f4c1eb848e6a72c5c6cb48ef129ecd907cd32f2703df96e162a3049df975d39e1dc62b12c67e6003415cbe9def60b54f82952256b1768

  • SSDEEP

    3072:bc7PTlvaUu4eCdxG7psbiIbhou3QepC/tcIZQjSgbE77mOAg0Fuj0nRgrV9:bsLgCyC513QepUcmZ7RAOnV9

Malware Config

Targets

    • Target

      0c4b93248f879c55af0dbadabbfbcbd3.exe

    • Size

      200KB

    • MD5

      0c4b93248f879c55af0dbadabbfbcbd3

    • SHA1

      28f43c6a01ca3ee74ca1fc05bb37524a63fcc3da

    • SHA256

      193cd25a701fee258502ce638347a3a94ca4dcb82acba581fb3faafdf4dfe9ae

    • SHA512

      eba37ec05745ebb2848f4c1eb848e6a72c5c6cb48ef129ecd907cd32f2703df96e162a3049df975d39e1dc62b12c67e6003415cbe9def60b54f82952256b1768

    • SSDEEP

      3072:bc7PTlvaUu4eCdxG7psbiIbhou3QepC/tcIZQjSgbE77mOAg0Fuj0nRgrV9:bsLgCyC513QepUcmZ7RAOnV9

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks