Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5UUHP_Built.exe

  • Size

    6.9MB

  • Sample

    241014-twabystgrg

  • MD5

    f760292c0a8c2dfd7802fb98988fa169

  • SHA1

    376dc5485837e855f2c2db807c87c8b206e551d1

  • SHA256

    0371fbb8cb808f20357038faabaa566585e37a234fc29fb981c690c08ca72cac

  • SHA512

    e8f29bfbbf3d7d12e69c320aa8e86cbc1b7ef362eaff65bf628b53b5a53d4dd446adae78f73eda8a85f21a57ea9aafbe2a80cfb36c5451c4eca5200c0336e973

  • SSDEEP

    98304:ABDjWM8JEE1r2CWamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIJ:AB0DeNTfm/pf+xk4dWRptrbWOjgrc

Malware Config

Targets

    • Target

      5UUHP_Built.exe

    • Size

      6.9MB

    • MD5

      f760292c0a8c2dfd7802fb98988fa169

    • SHA1

      376dc5485837e855f2c2db807c87c8b206e551d1

    • SHA256

      0371fbb8cb808f20357038faabaa566585e37a234fc29fb981c690c08ca72cac

    • SHA512

      e8f29bfbbf3d7d12e69c320aa8e86cbc1b7ef362eaff65bf628b53b5a53d4dd446adae78f73eda8a85f21a57ea9aafbe2a80cfb36c5451c4eca5200c0336e973

    • SSDEEP

      98304:ABDjWM8JEE1r2CWamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIJ:AB0DeNTfm/pf+xk4dWRptrbWOjgrc

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.