Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a8797694cda07fca8c4fd7e7109e95001995ffaeb55aed0c484f950d78284e0f

  • Size

    1.9MB

  • Sample

    240423-ckherabe9z

  • MD5

    6c359b235f8f257003417243c9a5e5ab

  • SHA1

    bc03fba52ed6d1d299ec97930399ce98d73ba056

  • SHA256

    a8797694cda07fca8c4fd7e7109e95001995ffaeb55aed0c484f950d78284e0f

  • SHA512

    83f20a4c18e2ade5f5bb06f0c97abf619f1ae2dcb9e3248956e8df1d812f6ce3b732112667e7c39e89d1fbd60740ea736e1ee1f3187cc971f64fe250e6a5e099

  • SSDEEP

    49152:xq7BRKUfISWebvKrw0TFKSiwRTW/03SJxsP:xq7DKUfLbCpxiwRK/MVP

Malware Config

Targets

    • Target

      a8797694cda07fca8c4fd7e7109e95001995ffaeb55aed0c484f950d78284e0f

    • Size

      1.9MB

    • MD5

      6c359b235f8f257003417243c9a5e5ab

    • SHA1

      bc03fba52ed6d1d299ec97930399ce98d73ba056

    • SHA256

      a8797694cda07fca8c4fd7e7109e95001995ffaeb55aed0c484f950d78284e0f

    • SHA512

      83f20a4c18e2ade5f5bb06f0c97abf619f1ae2dcb9e3248956e8df1d812f6ce3b732112667e7c39e89d1fbd60740ea736e1ee1f3187cc971f64fe250e6a5e099

    • SSDEEP

      49152:xq7BRKUfISWebvKrw0TFKSiwRTW/03SJxsP:xq7DKUfLbCpxiwRK/MVP

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks