Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c0970a7ba4c8a986c168aecce3514561ebb6d97672631642b4f44c11a42a4fa5

  • Size

    408KB

  • Sample

    240727-gv9dfa1dlq

  • MD5

    720cba07a7923c7462732a8c100408c4

  • SHA1

    b8bdea7d977fd34b63d9b531d4231d891e386f60

  • SHA256

    c0970a7ba4c8a986c168aecce3514561ebb6d97672631642b4f44c11a42a4fa5

  • SHA512

    72a9e4a6276cf992b9bd0deb48196574a39b0495cac8f72f6db70cb1bccf13d99f227966ec1cc5d698c1921768426b872d87e423bc9ef806436721d05fe3f030

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4g:gtRfJcNYFNm8UhlZGseg

Malware Config

Targets

    • Target

      c0970a7ba4c8a986c168aecce3514561ebb6d97672631642b4f44c11a42a4fa5

    • Size

      408KB

    • MD5

      720cba07a7923c7462732a8c100408c4

    • SHA1

      b8bdea7d977fd34b63d9b531d4231d891e386f60

    • SHA256

      c0970a7ba4c8a986c168aecce3514561ebb6d97672631642b4f44c11a42a4fa5

    • SHA512

      72a9e4a6276cf992b9bd0deb48196574a39b0495cac8f72f6db70cb1bccf13d99f227966ec1cc5d698c1921768426b872d87e423bc9ef806436721d05fe3f030

    • SSDEEP

      6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4g:gtRfJcNYFNm8UhlZGseg

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks