Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3e22e53f409b3e9d4523af3e74b30c44

  • Size

    3.6MB

  • Sample

    231225-1k4jzsegdk

  • MD5

    3e22e53f409b3e9d4523af3e74b30c44

  • SHA1

    178e7ff1870e1d62688c4e396572afd7b8bb839b

  • SHA256

    18063aec34073060ab335406a1303cbdb8bbbd11e4b02358888ee5681339a796

  • SHA512

    60d1adf0819d8317dff03e483debbddda0577ba3f91eba545c8a3a44d82ba3e2e9f9cc5e27d4a25bfb8c512aa256993ae5fc8aa2e1dd9f7069e86cfcc5f88e55

  • SSDEEP

    3072:4HqLaIXw+0L/dJjDJgFpCsCCw+dMhWmTC7hwue6DuqDz:B

Malware Config

Targets

    • Target

      3e22e53f409b3e9d4523af3e74b30c44

    • Size

      3.6MB

    • MD5

      3e22e53f409b3e9d4523af3e74b30c44

    • SHA1

      178e7ff1870e1d62688c4e396572afd7b8bb839b

    • SHA256

      18063aec34073060ab335406a1303cbdb8bbbd11e4b02358888ee5681339a796

    • SHA512

      60d1adf0819d8317dff03e483debbddda0577ba3f91eba545c8a3a44d82ba3e2e9f9cc5e27d4a25bfb8c512aa256993ae5fc8aa2e1dd9f7069e86cfcc5f88e55

    • SSDEEP

      3072:4HqLaIXw+0L/dJjDJgFpCsCCw+dMhWmTC7hwue6DuqDz:B

    • Modifies firewall policy service

    • Modifies security service

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Drops file in Drivers directory

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks