Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    df2c4531d003c74654cc3c0791925cc4f06fda365074fc4314f0bfe4ff0d97b8

  • Size

    412KB

  • Sample

    240908-w8vjrs1amq

  • MD5

    f8ee0f3e2f454fa5080eef3f6acf4a95

  • SHA1

    1c03cb1a47a6d2cdfa4f174edd27855d7ca5f748

  • SHA256

    df2c4531d003c74654cc3c0791925cc4f06fda365074fc4314f0bfe4ff0d97b8

  • SHA512

    2615a03799723ecbdc0df8e2168ee7d8f5480836bff8d8e1e038841cde2e9d0c35c84a76bfb865e518ed2736d1dc1d581fd50230eefd3d6a30f6750816ab6632

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4G:gtRfJcNYFNm8UhlZGseG

Malware Config

Targets

    • Target

      df2c4531d003c74654cc3c0791925cc4f06fda365074fc4314f0bfe4ff0d97b8

    • Size

      412KB

    • MD5

      f8ee0f3e2f454fa5080eef3f6acf4a95

    • SHA1

      1c03cb1a47a6d2cdfa4f174edd27855d7ca5f748

    • SHA256

      df2c4531d003c74654cc3c0791925cc4f06fda365074fc4314f0bfe4ff0d97b8

    • SHA512

      2615a03799723ecbdc0df8e2168ee7d8f5480836bff8d8e1e038841cde2e9d0c35c84a76bfb865e518ed2736d1dc1d581fd50230eefd3d6a30f6750816ab6632

    • SSDEEP

      6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4G:gtRfJcNYFNm8UhlZGseG

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks