Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42

  • Size

    126KB

  • Sample

    240416-xvkyvabf7w

  • MD5

    3812a9cda64039b9095e5805861e68d0

  • SHA1

    ebe050574c3ebfa140b9d7c3c0048d2036b8ce2d

  • SHA256

    10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42

  • SHA512

    d66fddd464fef3219ac0951320053dd600d772b65a6aef4d47d25676eeddd0756a3c0935dacbdd89133227ee38ad8046ae1f859b6d49579928b04e4ac4a0e9df

  • SSDEEP

    3072:VjbLl/gvQoutv4DQ1Tj4mYWR/R4nkPR/1aVuydlaW7HBVJoxdAN0JjpTZK:VjluQoSv4DSIo5R4nM/40ydlaW7lsto

Malware Config

Targets

    • Target

      10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42

    • Size

      126KB

    • MD5

      3812a9cda64039b9095e5805861e68d0

    • SHA1

      ebe050574c3ebfa140b9d7c3c0048d2036b8ce2d

    • SHA256

      10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42

    • SHA512

      d66fddd464fef3219ac0951320053dd600d772b65a6aef4d47d25676eeddd0756a3c0935dacbdd89133227ee38ad8046ae1f859b6d49579928b04e4ac4a0e9df

    • SSDEEP

      3072:VjbLl/gvQoutv4DQ1Tj4mYWR/R4nkPR/1aVuydlaW7HBVJoxdAN0JjpTZK:VjluQoSv4DSIo5R4nM/40ydlaW7lsto

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks