Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f

  • Size

    403KB

  • Sample

    240421-dwjydshf66

  • MD5

    261d4a7b37ef1259131dcdd74d40656c

  • SHA1

    28e6f79d0eb036f3cb775b793ef73a5651232281

  • SHA256

    9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f

  • SHA512

    6345acc12284014dd9522cd8073767a16d1a9ae37c929fffd251226ad6ebae93776841c7279755de93d131ac48ca7774a2375b101bd5f90cf625560a83b75463

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse

Malware Config

Targets

    • Target

      9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f

    • Size

      403KB

    • MD5

      261d4a7b37ef1259131dcdd74d40656c

    • SHA1

      28e6f79d0eb036f3cb775b793ef73a5651232281

    • SHA256

      9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f

    • SHA512

      6345acc12284014dd9522cd8073767a16d1a9ae37c929fffd251226ad6ebae93776841c7279755de93d131ac48ca7774a2375b101bd5f90cf625560a83b75463

    • SSDEEP

      6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks