Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9c073f373478de7ebfb0a1cf8021095ecb24e07e5e5870ae0ea6c03f71d4ef34

  • Size

    7.3MB

  • Sample

    240530-3ahkwaef96

  • MD5

    f821be97eae32226308cc4cb0b7892a3

  • SHA1

    96527037633e9b525b84da8772ec213783bf6041

  • SHA256

    9c073f373478de7ebfb0a1cf8021095ecb24e07e5e5870ae0ea6c03f71d4ef34

  • SHA512

    007cc893e3d2f92b7f8e8c0afc4d7360b943b03ff6f6f964e7f1330ed2341229402c507f0e1485973e310af065ace3df85287b89f3b8d9aed7ee6fe6c10661cd

  • SSDEEP

    196608:91O639u0W4n6CvwtKRXhgYHVHmvKxDMSCitowBfq09B4gU7f+8+:3O639NWo6w8U/1Hmv83to0q0zU7WF

Malware Config

Targets

    • Target

      9c073f373478de7ebfb0a1cf8021095ecb24e07e5e5870ae0ea6c03f71d4ef34

    • Size

      7.3MB

    • MD5

      f821be97eae32226308cc4cb0b7892a3

    • SHA1

      96527037633e9b525b84da8772ec213783bf6041

    • SHA256

      9c073f373478de7ebfb0a1cf8021095ecb24e07e5e5870ae0ea6c03f71d4ef34

    • SHA512

      007cc893e3d2f92b7f8e8c0afc4d7360b943b03ff6f6f964e7f1330ed2341229402c507f0e1485973e310af065ace3df85287b89f3b8d9aed7ee6fe6c10661cd

    • SSDEEP

      196608:91O639u0W4n6CvwtKRXhgYHVHmvKxDMSCitowBfq09B4gU7f+8+:3O639NWo6w8U/1Hmv83to0q0zU7WF

    • Modifies Windows Defender Real-time Protection settings

    • Windows security bypass

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks