Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    654dcb4f04e35d08163c591036679848506f335a4c78c94781eb1f3f6c9056af

  • Size

    200KB

  • Sample

    241011-25nvpsyhma

  • MD5

    fd57199e11b6177f1ec6bc90d6539ba3

  • SHA1

    070e58dd95d5a9b9fc9be0028660facb44059fc7

  • SHA256

    654dcb4f04e35d08163c591036679848506f335a4c78c94781eb1f3f6c9056af

  • SHA512

    a70e0966e265df118c02febbb1908672ab2cf91003116cf880aca2dafcc7ae429e50a06ecea7148049b0014987044aecae30961f8f6a2dad300e610fc3e7befb

  • SSDEEP

    3072:fP5gvNVLIfHQja1RfmLQADwSKkhU+tLgT5lODbiC8r1PkTq:X2vnSwjaOcADw9cUeCOf8

Malware Config

Targets

    • Target

      654dcb4f04e35d08163c591036679848506f335a4c78c94781eb1f3f6c9056af

    • Size

      200KB

    • MD5

      fd57199e11b6177f1ec6bc90d6539ba3

    • SHA1

      070e58dd95d5a9b9fc9be0028660facb44059fc7

    • SHA256

      654dcb4f04e35d08163c591036679848506f335a4c78c94781eb1f3f6c9056af

    • SHA512

      a70e0966e265df118c02febbb1908672ab2cf91003116cf880aca2dafcc7ae429e50a06ecea7148049b0014987044aecae30961f8f6a2dad300e610fc3e7befb

    • SSDEEP

      3072:fP5gvNVLIfHQja1RfmLQADwSKkhU+tLgT5lODbiC8r1PkTq:X2vnSwjaOcADw9cUeCOf8

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks