Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

Patch_MB 4.6.x.exe

windows7-x64

8

Patch_MB 4.6.x.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18cdb4710669e0c9bac728158a950469.bin

  • Size

    64.9MB

  • Sample

    231211-bh72yshbak

  • MD5

    18cdb4710669e0c9bac728158a950469

  • SHA1

    93ba0dd1884c985f00a4f64e8b5117e0b84b560e

  • SHA256

    8d4cf683249b4a52d4a4291c9346adfd6ce7267a0b45a570ec4758461cd4d535

  • SHA512

    dd09aae99e246d4d92220344062623398c51481ebcdbf0c123f2f453ae089478a9c85b5a37296f179bc4e22796ef2260575545d270b95201584b9b9e3855c40d

  • SSDEEP

    1572864:Y4EavAhHKdwIaY+Oyt28Pjr+lvpFMr7Es114EnxxIUXGUDYgynHBg0DAk:Y4Ea4hHUohjr+lsss114EnxJYgynO5k

Score
8/10
discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      Patch_MB 4.6.x.exe

    • Size

      65.2MB

    • MD5

      221c91446a819b12ffe65263f9174928

    • SHA1

      9f7464100e7ffc37116a6e55fb0575cb832fd523

    • SHA256

      38b73b21597d336878202015e7a137a93b266e3a4d71274a24671cdd54b3d000

    • SHA512

      0da45b29849c52dc2e1f91ff3a69b611717f32165bde4358b54d182337654f8acecb9f491d897428b388bf630a1a80dfdcd92433ab238fa2cd5788191985b0c2

    • SSDEEP

      1572864:HOUOMLEmI4Z8TDCNU63i/BNJNRaGUwDfSzE3FjBdJ14A8/IuNbDdwNVLD:HOUOCEmzfWBNJN4iSzE3FjBCIuNbu/D

    Score
    8/10
    discoverypersistencespywarestealer

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks