Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    262634c394e85c2ee77138dae9b0ef640a8d99589e9f9f7ebb4ed778ed278c47

  • Size

    8.2MB

  • Sample

    240914-v8qp5swepj

  • MD5

    043d4a72233314a99bc3d0516272b492

  • SHA1

    91c18b41ee030ab6d0c69b6bc4eb7df29f99e66e

  • SHA256

    262634c394e85c2ee77138dae9b0ef640a8d99589e9f9f7ebb4ed778ed278c47

  • SHA512

    1cc074e459e3096ba84e2fb578549d91ac80b0dadae150f45a9eae16290e00e92b6397df1e2e8efd98cb430153dd83a3ce38485f29bc0c7e7f3e6f8c0fcf22a9

  • SSDEEP

    196608:dBg8VEvwfI9jUC2gYBYv3vbW4SEf+iITx1U6nR:k8VEkIH2gYBgDWZjTnzR

Malware Config

Targets

    • Target

      262634c394e85c2ee77138dae9b0ef640a8d99589e9f9f7ebb4ed778ed278c47

    • Size

      8.2MB

    • MD5

      043d4a72233314a99bc3d0516272b492

    • SHA1

      91c18b41ee030ab6d0c69b6bc4eb7df29f99e66e

    • SHA256

      262634c394e85c2ee77138dae9b0ef640a8d99589e9f9f7ebb4ed778ed278c47

    • SHA512

      1cc074e459e3096ba84e2fb578549d91ac80b0dadae150f45a9eae16290e00e92b6397df1e2e8efd98cb430153dd83a3ce38485f29bc0c7e7f3e6f8c0fcf22a9

    • SSDEEP

      196608:dBg8VEvwfI9jUC2gYBYv3vbW4SEf+iITx1U6nR:k8VEkIH2gYBgDWZjTnzR

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks