Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    olaucher.exe

  • Size

    101.3MB

  • Sample

    240620-vpgywssfrr

  • MD5

    631172439a50b0da8c8378952394ccfa

  • SHA1

    e612fa2794eaf15d44f060649246b3dadfd31253

  • SHA256

    02464c6713a8cea33b658e3e1c2253e6c464d69ee538b5d5d7ad9e089637a5ec

  • SHA512

    10cfa4bba3cb9409ede48d50bd9878f220c4762ea6813f7e8da2c43273b85dffa67504e986a6da7a9b64799a02d8d63abe225fec29ece0e944a8833be2744a43

  • SSDEEP

    3145728:XK9bRB86X027WzjzGRT+Pkt+408YOhgDM:XqqkSjx/408Y9A

Malware Config

Targets

    • Target

      olaucher.exe

    • Size

      101.3MB

    • MD5

      631172439a50b0da8c8378952394ccfa

    • SHA1

      e612fa2794eaf15d44f060649246b3dadfd31253

    • SHA256

      02464c6713a8cea33b658e3e1c2253e6c464d69ee538b5d5d7ad9e089637a5ec

    • SHA512

      10cfa4bba3cb9409ede48d50bd9878f220c4762ea6813f7e8da2c43273b85dffa67504e986a6da7a9b64799a02d8d63abe225fec29ece0e944a8833be2744a43

    • SSDEEP

      3145728:XK9bRB86X027WzjzGRT+Pkt+408YOhgDM:XqqkSjx/408Y9A

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks