Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    idman642build3.exe

  • Size

    11.5MB

  • Sample

    240304-p8mqlaca29

  • MD5

    84582a8bb1288350b17d9fec4323a8a4

  • SHA1

    2703a051f265c72a46099021e7873bfcbe073787

  • SHA256

    26e1d8e4838ee3334b1d9c2622ed6197c93e87487bc0fefcf29216cee72858f5

  • SHA512

    4bf7c1fefb62c055d703505b742484bb3250d98bb95f01690090414966a2711ba2991b312944b32c058b6ca4ee7cfebb9f323b274b4326a178502d032ecd1739

  • SSDEEP

    196608:jlX5piz5kAUfv6Tbj/66PWBNDyhZNUZMnarsrfoNpA/ZA2Bswc9D2pejlN9rpf:Hk5Pb/nWWirs0pYZhc9Kp6N9rpf

Malware Config

Targets

    • Target

      idman642build3.exe

    • Size

      11.5MB

    • MD5

      84582a8bb1288350b17d9fec4323a8a4

    • SHA1

      2703a051f265c72a46099021e7873bfcbe073787

    • SHA256

      26e1d8e4838ee3334b1d9c2622ed6197c93e87487bc0fefcf29216cee72858f5

    • SHA512

      4bf7c1fefb62c055d703505b742484bb3250d98bb95f01690090414966a2711ba2991b312944b32c058b6ca4ee7cfebb9f323b274b4326a178502d032ecd1739

    • SSDEEP

      196608:jlX5piz5kAUfv6Tbj/66PWBNDyhZNUZMnarsrfoNpA/ZA2Bswc9D2pejlN9rpf:Hk5Pb/nWWirs0pYZhc9Kp6N9rpf

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks