Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5d8fefcafe6dc62e14a48d88d3d82c3a074129a41effc5f360763d1d6c225ac5

  • Size

    990KB

  • Sample

    240430-2j1x5sbd36

  • MD5

    4198d0f98576de6f49ec5b600357c356

  • SHA1

    a9f8131f9e0fca0d7157cdc1cf9ab6a86dd3e6df

  • SHA256

    5d8fefcafe6dc62e14a48d88d3d82c3a074129a41effc5f360763d1d6c225ac5

  • SHA512

    304afd4b4d1f5c7f48890a892a862a8e2b7e4084b2f83ba5816451d6ce9d112c8ab3fcd1fadb82151df787c4cb0c543f1c15601aa007214c0216cf4914783b13

  • SSDEEP

    24576:VjgrI/e7JF0hr4klcUuJPctTrM5FE32HmyHLo:+0/ZcklXE0t/IFtGy0

Malware Config

Targets

    • Target

      5d8fefcafe6dc62e14a48d88d3d82c3a074129a41effc5f360763d1d6c225ac5

    • Size

      990KB

    • MD5

      4198d0f98576de6f49ec5b600357c356

    • SHA1

      a9f8131f9e0fca0d7157cdc1cf9ab6a86dd3e6df

    • SHA256

      5d8fefcafe6dc62e14a48d88d3d82c3a074129a41effc5f360763d1d6c225ac5

    • SHA512

      304afd4b4d1f5c7f48890a892a862a8e2b7e4084b2f83ba5816451d6ce9d112c8ab3fcd1fadb82151df787c4cb0c543f1c15601aa007214c0216cf4914783b13

    • SSDEEP

      24576:VjgrI/e7JF0hr4klcUuJPctTrM5FE32HmyHLo:+0/ZcklXE0t/IFtGy0

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks