Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5ca0de97d42ea910381b8527612adab5.exe

  • Size

    1.0MB

  • Sample

    240106-ly41caeaf6

  • MD5

    5ca0de97d42ea910381b8527612adab5

  • SHA1

    923ea5a3367898223b6ef6fec311991d1596f3c7

  • SHA256

    04c4176ba82afc4749e1ffefed306badc56caf687b102d2917606e7445393d76

  • SHA512

    82daa9a14d74ed40f3403a7650f8e82aba02fa9191e53dc5ff1adf3f928092ed442a01c1623da147ff2f57f053f09910f35fdbadf7b2f8c8471b8ab6f5a83c5a

  • SSDEEP

    3072:Cqu7aslM9lhLElGtSIs48417nFdcQ4FdHLDC62ftOS2N:CqrK

Malware Config

Targets

    • Target

      5ca0de97d42ea910381b8527612adab5.exe

    • Size

      1.0MB

    • MD5

      5ca0de97d42ea910381b8527612adab5

    • SHA1

      923ea5a3367898223b6ef6fec311991d1596f3c7

    • SHA256

      04c4176ba82afc4749e1ffefed306badc56caf687b102d2917606e7445393d76

    • SHA512

      82daa9a14d74ed40f3403a7650f8e82aba02fa9191e53dc5ff1adf3f928092ed442a01c1623da147ff2f57f053f09910f35fdbadf7b2f8c8471b8ab6f5a83c5a

    • SSDEEP

      3072:Cqu7aslM9lhLElGtSIs48417nFdcQ4FdHLDC62ftOS2N:CqrK

    • Modifies firewall policy service

    • Modifies security service

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Drops file in Drivers directory

    • Sets file execution options in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks