Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    new.exe

  • Size

    37.6MB

  • Sample

    240626-qpm3pawfrb

  • MD5

    eb0162868504271a9567b58ba2ad7835

  • SHA1

    53ea6c4b5c1a2f5e98a90b14ff418c89824cb730

  • SHA256

    dcfefc6ab68f29b9b2d1119bff758dd024d922b5ec7fa7d70110e50807863d86

  • SHA512

    da2b5d6bdfc250216014d3cf30d4c26a22738538b894f988054594540a6a4d8a0c6affd0f5c1e96d424136b065647aeff89de5f15e1d8ba50f74b739f982a851

  • SSDEEP

    786432:R3on1HvSzxAMNiFZArYsQnT1K3WLCToJb9:RYn1HvSpNiXmAIlTo3

Malware Config

Targets

    • Target

      new.exe

    • Size

      37.6MB

    • MD5

      eb0162868504271a9567b58ba2ad7835

    • SHA1

      53ea6c4b5c1a2f5e98a90b14ff418c89824cb730

    • SHA256

      dcfefc6ab68f29b9b2d1119bff758dd024d922b5ec7fa7d70110e50807863d86

    • SHA512

      da2b5d6bdfc250216014d3cf30d4c26a22738538b894f988054594540a6a4d8a0c6affd0f5c1e96d424136b065647aeff89de5f15e1d8ba50f74b739f982a851

    • SSDEEP

      786432:R3on1HvSzxAMNiFZArYsQnT1K3WLCToJb9:RYn1HvSpNiXmAIlTo3

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks