Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    82e371fd28959c3b08f8de9eba4b64f13f5497a0baa8555c5cbb21a058d59516N

  • Size

    512KB

  • Sample

    241014-w385zazbph

  • MD5

    9be0ba7b2e2ada8bf29f8460c451b1b0

  • SHA1

    763f4c9651b6b14b9c4e0763971aacc7b0ca7335

  • SHA256

    82e371fd28959c3b08f8de9eba4b64f13f5497a0baa8555c5cbb21a058d59516

  • SHA512

    10e9dcd5025e536133c8866eb331a29c2639463f0cce281bcbb7303672398122e33c3b7dcbaa3dd96a41f798fcb13026b915cbdae26e36d02ef629b29b4b6e4a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v

Malware Config

Targets

    • Target

      82e371fd28959c3b08f8de9eba4b64f13f5497a0baa8555c5cbb21a058d59516N

    • Size

      512KB

    • MD5

      9be0ba7b2e2ada8bf29f8460c451b1b0

    • SHA1

      763f4c9651b6b14b9c4e0763971aacc7b0ca7335

    • SHA256

      82e371fd28959c3b08f8de9eba4b64f13f5497a0baa8555c5cbb21a058d59516

    • SHA512

      10e9dcd5025e536133c8866eb331a29c2639463f0cce281bcbb7303672398122e33c3b7dcbaa3dd96a41f798fcb13026b915cbdae26e36d02ef629b29b4b6e4a

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks