Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3a132d79ff5b577c8ea00bad8da6304d

  • Size

    283KB

  • Sample

    231231-rz4c4aabd2

  • MD5

    3a132d79ff5b577c8ea00bad8da6304d

  • SHA1

    3347daee9fa051b316b93c1541bbb0908696c2f8

  • SHA256

    c8ca2cde76eafffe4bb6640ef8f9eb5acefaf0efaec37048ff058400248ab019

  • SHA512

    9ac5912a9771f76c423f62bc6d7a0cc941ed6f1f59429ddc70d18d614f8d7378f62324eeea244e0af17cb5183c4d8fcb99c2f3f07078803d53b48752c76d610a

  • SSDEEP

    6144:VDplsxscrEZGUT1eIbLNPSkLpwDDMfZbwVts92qo1bY:1byEZTeWsJDMdwV292qo1b

Malware Config

Targets

    • Target

      3a132d79ff5b577c8ea00bad8da6304d

    • Size

      283KB

    • MD5

      3a132d79ff5b577c8ea00bad8da6304d

    • SHA1

      3347daee9fa051b316b93c1541bbb0908696c2f8

    • SHA256

      c8ca2cde76eafffe4bb6640ef8f9eb5acefaf0efaec37048ff058400248ab019

    • SHA512

      9ac5912a9771f76c423f62bc6d7a0cc941ed6f1f59429ddc70d18d614f8d7378f62324eeea244e0af17cb5183c4d8fcb99c2f3f07078803d53b48752c76d610a

    • SSDEEP

      6144:VDplsxscrEZGUT1eIbLNPSkLpwDDMfZbwVts92qo1bY:1byEZTeWsJDMdwV292qo1b

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Disables taskbar notifications via registry modification

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks