Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    eb7329d18dd23a237cfd3f0daebfd27e.bin

  • Size

    1.4MB

  • Sample

    240826-cbhzxsyblg

  • MD5

    c794b65de59a316bc7d1c9204d3260e7

  • SHA1

    ab5508b8ceb1a85383cbdd743a3bfafd784c5ca1

  • SHA256

    0ddacba3ad9dd45a790e0b89bacb74eb19b1ea53f62a1cb872615b99a543e397

  • SHA512

    134cfefa327997e590de2eb2d57dd7be0614ac7f18e58550724836564fbed057340192ce6956ca9ded5f5376c56c59ed56979d15b3cf1d14ed5e181f8b5da2fb

  • SSDEEP

    24576:IcsuWj1q0mwkk5I3HorNoGoKRwHyYna9G9EriTOQJC6kFNNlJdhATWr5ki5x:Icsj5xV+3CQKRwBLBTO6kTNlJdhATY1/

Malware Config

Targets

    • Target

      7c17416063fed1326321d220e18cabc48ff88c49d5d4aa220f0ebf7846c29e5d.exe

    • Size

      3.0MB

    • MD5

      eb7329d18dd23a237cfd3f0daebfd27e

    • SHA1

      863d5379ff30276d611bca4bb3a4bb96ad8bb82c

    • SHA256

      7c17416063fed1326321d220e18cabc48ff88c49d5d4aa220f0ebf7846c29e5d

    • SHA512

      7304e1f4a257f9dfa33577c47b4a07399391fd3927f170911a51aabd7c2cf08ae42dd96d2210d25bbb01efa7bc31f1841e7c862b873e351618e4a882eeb21e3a

    • SSDEEP

      49152:nz1BnfvgahemTtgXYSXggDb5B/NOYl/O4pTslfgSjLaTEB4tp0MgfG:8aheWgtNS/nLaTE

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks