Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb

  • Size

    2.3MB

  • Sample

    240817-zdhhhaybjq

  • MD5

    6795e1d303b6ffa9b9fdaeaeac35bee7

  • SHA1

    373734016d1261151b632f5ca17914eca92e2821

  • SHA256

    318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb

  • SHA512

    69bcfed71817c187aad2a2a9edc6f0912b1191182d8fdee048435c17f87d8d117904f6cb66bd5f810e2581fe93c0c21dfd250e107f8c9eafdd1c4d90c2511b4f

  • SSDEEP

    49152:Bjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:BrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Malware Config

Targets

    • Target

      318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb

    • Size

      2.3MB

    • MD5

      6795e1d303b6ffa9b9fdaeaeac35bee7

    • SHA1

      373734016d1261151b632f5ca17914eca92e2821

    • SHA256

      318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb

    • SHA512

      69bcfed71817c187aad2a2a9edc6f0912b1191182d8fdee048435c17f87d8d117904f6cb66bd5f810e2581fe93c0c21dfd250e107f8c9eafdd1c4d90c2511b4f

    • SSDEEP

      49152:Bjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:BrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks