Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    985064a0e5b1d348d94c7427483b25debac4467a649c671207aa2cabfdcf9dfd

  • Size

    2.3MB

  • Sample

    240913-ay6y6avdrb

  • MD5

    77f59d68727acc87da5dd18c10c5327e

  • SHA1

    f18ca4f1d2bd7cd96c99db5f72eb4cab7442097d

  • SHA256

    985064a0e5b1d348d94c7427483b25debac4467a649c671207aa2cabfdcf9dfd

  • SHA512

    d691aca860f12f042097db7c90b8313c786e0619112f8f17b37b41139e836b54852c99a31e8a1723465305003c22a9b9b2fe591f4dc8bae0ea48ed200fb8cb4f

  • SSDEEP

    49152:Rjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:RrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Malware Config

Targets

    • Target

      985064a0e5b1d348d94c7427483b25debac4467a649c671207aa2cabfdcf9dfd

    • Size

      2.3MB

    • MD5

      77f59d68727acc87da5dd18c10c5327e

    • SHA1

      f18ca4f1d2bd7cd96c99db5f72eb4cab7442097d

    • SHA256

      985064a0e5b1d348d94c7427483b25debac4467a649c671207aa2cabfdcf9dfd

    • SHA512

      d691aca860f12f042097db7c90b8313c786e0619112f8f17b37b41139e836b54852c99a31e8a1723465305003c22a9b9b2fe591f4dc8bae0ea48ed200fb8cb4f

    • SSDEEP

      49152:Rjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:RrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks